A security knowledge generation method and system based on large language model

Abstract

The present invention discloses a method and system for generating security knowledge based on a large language model, which relates to the cross-technical field of artificial intelligence and network security, including collecting text records, network traffic logs, image data and video clips in a network environment to form a multimodal heterogeneous data set; using the dynamically updated memory state as an additional context based on the large language model to generate an enhanced context vector; combining the enhanced context vector with the dynamically updated memory state to generate a security knowledge entry. The present invention integrates a variety of network data, uses advanced multimodal technology to deeply encode information, combines dynamic memory networks with large language models, realizes efficient fusion of data and generation of context-related security knowledge, improves the accuracy and timeliness of security knowledge generation, and has the ability to flexibly adjust strategies according to environmental changes, providing a more accurate and comprehensive solution for network security protection.

Description

Technical Field

[0001] The present invention relates to the cross-technical field of artificial intelligence and network security, and in particular to a method and system for generating security knowledge based on a large language model. Background Art

[0002] In today's digital age, with the rapid development of Internet technology and the continuous improvement of intelligence, network security has become the focus of attention in the field of information technology. Traditional security strategies and defense mechanisms have gradually shown their limitations, especially in the face of increasingly complex network attack methods and massive heterogeneous data processing needs. Therefore, how to efficiently and accurately identify and respond to network security threats has become an urgent problem to be solved. In recent years, the rise of artificial intelligence, especially natural language processing and deep learning technology, has opened up new paths for the automatic extraction and generation of security knowledge.

[0003] In the field of security knowledge generation, early research mostly focused on rule matching, statistical analysis, and expert systems. These methods rely on manually written rules and expert experience and are difficult to adapt to rapidly changing network environments and attack patterns. Subsequently, with the advancement of machine learning algorithms, some models began to try to learn knowledge from a large number of security logs, reports, and documents, but these models are usually limited to single-modal data and cannot fully utilize the rich and diverse information resources in the network environment, such as text, images, and videos. In addition, they are often inefficient in processing high-dimensional, unstructured data, and lack the ability to effectively integrate and understand cross-modal information, resulting in significant bottlenecks in the generation and application of security knowledge. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a method and system for generating secure knowledge based on a large language model to solve the limitations in processing multimodal heterogeneous data, realizing cross-modal feature fusion, dynamic memory updating, and context-sensitive knowledge generation.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In the first aspect, an embodiment of the present invention provides a method for generating security knowledge based on a large language model, which includes collecting text records, network traffic logs, image materials and video clips in a network environment to form a multimodal heterogeneous data set; deeply encoding the multimodal heterogeneous data set through a multimodal Transformer encoder, and combining it with a cross-modal attention mechanism to generate a cross-modal feature vector; inputting the cross-modal feature vector into a dynamic memory network to dynamically update the memory state; based on the large language model, using the dynamically updated memory state as additional context to generate an enhanced context vector; combining the enhanced context vector with the dynamically updated memory state to generate a security knowledge entry.

[0008] As a preferred solution of the method for generating security knowledge based on a large language model described in the present invention, wherein: the text records, network traffic logs, image data and video clips in the collected network environment form a multimodal heterogeneous data set, and the specific steps are:

[0009] Text records include text record data regularly collected from system logs, user behavior logs, chat and email records, and public network resource sources;

[0010] Network traffic logs include network traffic log data using full packet capture, full packet capture, and deep packet inspection for network traffic log parsing;

[0011] Image data includes image data collected from surveillance screenshots, web page screenshots, and graphic verification codes and image attachments;

[0012] Video clips include video clip data collected from surveillance videos, meeting records, and online live broadcasts and video sharing platforms;

[0013] The collected text records, network traffic logs, image data and video clip data are cleaned and labeled, and integrated into a multimodal heterogeneous data set.

[0014] As a preferred solution of the method for generating security knowledge based on a large language model according to the present invention, the deep encoding of the multimodal heterogeneous data set by a multimodal Transformer encoder refers to:

[0015] Use the BERT pre-trained model to encode the text and obtain the context modal vector;

[0016] After normalizing the traffic size and protocol type in the network traffic log, the traffic features are mapped to the vector space with the same dimension as the text through a fully connected layer to generate a dimensional space modal vector;

[0017] The ResNet pre-trained model is used to extract feature maps from image data and video clips, and a fixed-length modal vector is obtained through global average pooling.

[0018] Add position encoding to contextual modal vectors, dimensional space modal vectors, and fixed-length modal vectors to generate embedding vectors for each modality;

[0019] The embedding vectors of each modality are fused through the embedding space, and the fused multi-modal embedding vector is output;

[0020] A multi-head self-attention mechanism is applied to learn the features of the fused multimodal embedding vector from different angles, and the features are gradually refined through multiple encoder layers to complete deep encoding.

[0021] As a preferred solution of the method for generating security knowledge based on a large language model according to the present invention, the specific steps of generating a cross-modal feature vector are as follows:

[0022] Based on the deep encoding of multimodal heterogeneous datasets through the multimodal Transformer encoder, the modal similarity function is used to construct the inter-modal similarity matrix expression as follows:

[0023] ,

[0024] in, is the similarity score between the i-th and j-th samples on modality k, To balance the cosine similarity and the exponential weight of the Kullback-Leibler divergence The hyperparameters of is a hyperparameter that controls the Kullback-Leibler divergence weight, is the Kullback-Leibler divergence between the embedding vector of the i-th sample and the embedding vector of the j-th sample in modality k;

[0025] Based on the inter-modality similarity matrix , the expression of constructing the global cross-modal alignment matrix A is:

[0026] ,

[0027] in, is the degree of cross-modal alignment between the i-th and j-th samples, and k is the index variable of the modality type;

[0028] The cross-modal attention mechanism is used to dynamically adjust the weights of different modalities in the feature fusion process in the global cross-modal alignment matrix A. The expression of the cross-modal attention mechanism is:

[0029] ,

[0030] in, is the new feature vector of the i-th sample on modality k after adjustment by the attention mechanism, is the sigmoid activation function, is a scalar scaling factor, is the weight matrix in the attention mechanism, is the bias term, For Hadamard;

[0031] The embedding vectors processed by the inter-modal similarity matrix, the global cross-modal alignment matrix and the cross-modal attention mechanism are aggregated by modality, and the cross-modal feature vector expression is generated by weighted summation:

[0032] ,

[0033] in, is the cross-modal feature vector of the i-th sample.

[0034] As a preferred solution of the method for generating security knowledge based on a large language model according to the present invention, the cross-modal feature vector is input into a dynamic memory network to dynamically update the memory state, and the specific steps are as follows:

[0035] Content query function and gating function Perform feature combination, which includes cross-modal feature vectors and the current memory state , input to the memory update mechanism The expression is:

[0036] ,

[0037] ,

[0038] in, is the memory matrix at time step t, The memory matrix is ​​d-dimensional multiplied by is a real matrix of memory units, d is the dimension of the cross-modal feature vector, is the number of memory cells, Combine symbols for features;

[0039] In the update function Before each update, a forget gate is introduced The expression is:

[0040] ,

[0041] in, For time step t through the forget gate The new memory state after adjustment;

[0042] Dynamically update the memory state based on the update rules to generate the final dynamically updated memory state The expression is: .

[0043] As a preferred solution of the method for generating security knowledge based on a large language model of the present invention, wherein: the method of using the dynamically updated memory state as additional context based on the large language model refers to:

[0044] Will eventually dynamically update the memory state , mapped to the context vector C adapted to the large language model through linear transformation and nonlinear activation function, the expression is:

[0045] ,

[0046] in, is the rectified linear unit activation function, is the mapping matrix, is the bias term of the mapping matrix;

[0047] Combined with the normalized exponential function Dynamically adjust the attention weights with the context vector C The expression is:

[0048] ,

[0049] in, is the feature vector of the tth time step, is the weight matrix combining the memory state context vector C, is the bias term in the attention mechanism;

[0050] Based on attention weight , for the final dynamic update memory state Perform weighted summation to form an enhanced context vector , the expression is: .

[0051] As a preferred solution of the method for generating security knowledge based on a large language model of the present invention, the enhanced context vector is combined with the dynamically updated memory state to generate security knowledge items, and the specific steps are as follows:

[0052] Context vectors enhanced by dimension alignment and matching pairs and the final dynamically updated memory state Perform pre-processing;

[0053] The context vector and the final dynamically updated memory state , perform weighted summation, and generate the initial fusion vector expression as :

[0054] ,

[0055] in, Update memory status for final dynamic update The weight coefficient of is the context vector The weight coefficient of

[0056] The attention mechanism is used to fuse the sigmoid function to constrain the range. The specific expression is:

[0057] ,

[0058] in, for Relative to Importance adjustment factor;

[0059] according to To dynamically adjust the context vector The weight coefficient , and get the final fusion vector : ;

[0060] The final fusion vector , input to the large language model , the expression of generated security knowledge item y is:

[0061] ,

[0062] in, For large language models The process of generating text based on input information.

[0063] In the second aspect, the present invention provides a security knowledge generation system based on a large language model, including a multimodal data acquisition module, a cross-modal attention fusion module, a dynamic knowledge memory update module, and a security knowledge generation module; the multimodal data acquisition module is used to collect multimodal heterogeneous data sets of text records, network traffic logs, image materials and video clips in a network environment; the cross-modal attention fusion module is used to deeply encode the multimodal heterogeneous data sets through a multimodal Transformer encoder, and combine it with a cross-modal attention mechanism to generate a cross-modal feature vector; the dynamic knowledge memory update module is used to input the cross-modal feature vector into a dynamic memory network for dynamic update of the memory state; the security knowledge generation module is used to generate security knowledge entries based on the large language model using the dynamically updated memory state as additional context.

[0064] In a third aspect, an embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the method for generating security knowledge based on a large language model as described in the first aspect of the present invention is implemented.

[0065] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the method for generating security knowledge based on a large language model as described in the first aspect of the present invention.

[0066] The beneficial effects of the present invention are as follows: the present invention integrates text records, network traffic logs, image data and video clips in the network environment, uses advanced multimodal Transformer encoders and cross-modal attention mechanisms, not only realizing deep encoding of multi-source heterogeneous data, but also dynamically updates the memory state and generates security knowledge items with high context relevance through the organic combination of dynamic memory networks and large language models. This not only greatly improves the accuracy and timeliness of security knowledge generation, but also can be flexibly adjusted according to changes in the network environment, providing a more accurate and comprehensive security protection strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0068] Figure 1 This is a flowchart of the security knowledge generation method based on a large language model in Example 1.

[0069] Figure 2 This is a flowchart of deep encoding a multimodal heterogeneous dataset through a multimodal Transformer encoder in Example 1. DETAILED DESCRIPTION

[0070] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0071] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0072] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0073] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides a method for generating security knowledge based on a large language model, comprising the following steps:

[0074] S1. Collect text records, network traffic logs, image data and video clips in the network environment to form a multimodal heterogeneous dataset.

[0075] Furthermore, we collect text records, network traffic logs, image data and video clips in the network environment to form a multimodal heterogeneous data set. The specific steps are as follows:

[0076] Text records include text record data regularly collected from system logs, user behavior logs, chat and email records, and public network resource sources, emphasizing the diversity of data sources;

[0077] Network traffic logs include network traffic log data using full packet capture, full packet capture, and deep packet inspection for network traffic log parsing, ensuring the comprehensiveness and depth of traffic data;

[0078] Image data includes image data collected from surveillance screenshots, web page screenshots, graphic verification codes and image attachments; video clips include video clip data collected from surveillance videos, meeting records, and live webcasts and video sharing platforms. Image data and video clips reflect the extensive collection of visual information.

[0079] The collected text records, network traffic logs, image materials and video clips are cleaned and labeled, and integrated into a multimodal heterogeneous data set. This stage removes irrelevant or erroneous data and adds useful labels for subsequent processing, thereby enhancing the usability of the data.

[0080] It should be noted that the process of collecting text records, network traffic logs, image data and video clips in the network environment to form a multimodal heterogeneous data set emphasizes the diversity of data sources and the meticulousness of data processing, including obtaining text, traffic, image and video data from different sources, and improving data quality and availability through data cleaning and annotation, laying the foundation for subsequent multimodal analysis.

[0081] S2. Deeply encode the multimodal heterogeneous dataset through the multimodal Transformer encoder and combine it with the cross-modal attention mechanism to generate a cross-modal feature vector.

[0082] Furthermore, deep encoding of multimodal heterogeneous datasets through a multimodal Transformer encoder means:

[0083] The BERT pre-trained model is used to encode the text and obtain the contextual modal vector to capture the contextual relationship between words;

[0084] After normalizing the traffic size and protocol type in the network traffic log, the traffic features are mapped to the vector space with the same dimension as the text through a fully connected layer, generating a dimensional space modal vector so that different modal data can be compared in a common space;

[0085] The ResNet pre-trained model is used to extract feature maps from image data and video clips, and a fixed-length modal vector is obtained through global average pooling.

[0086] Add position encoding to contextual modal vectors, dimensional space modal vectors, and fixed-length modal vectors to generate embedding vectors for each modality;

[0087] By fusing the embedding vectors of each modality in the embedding space, the fused multimodal embedding vector is output, which enhances the spatiotemporal correlation of information.

[0088] A multi-head self-attention mechanism is applied to further refine the features, learn the features of the fused multimodal embedding vector from different angles, and gradually refine the features through multiple encoder layers to capture the complex relationship between different features, thus completing deep encoding.

[0089] It should be noted that when encoding multimodal features, the processing method of each modality is clarified: BERT is used for contextual understanding of text, network traffic logs are mapped through normalization and fully connected layers, and images and videos are extracted and pooled into fixed-length vectors using ResNet. These steps ensure the comparability and processing consistency of data of different modalities under a unified framework. At the same time, the information integration and feature extraction between modalities are further enhanced through position encoding, embedding space fusion, multi-head self-attention and other technologies, deepening the understanding of complex patterns;

[0090] Furthermore, based on the deep encoding of the multimodal heterogeneous dataset through the multimodal Transformer encoder, the modal similarity function is used to construct the inter-modal similarity matrix expression as follows:

[0091] ,

[0092] in, is the similarity score between the i-th and j-th samples on modality k, To balance the cosine similarity and the exponential weight of the Kullback-Leibler divergence By adjusting the hyperparameters The value of can change the model's emphasis on these two similarity metrics, thereby affecting the final feature fusion effect and model performance. To control the hyperparameters of the Kullback-Leibler divergence weight, it is used to measure the similarity between different modal data and balance the contributions of the two through the hyperparameters α and β. is the Kullback-Leibler divergence between the embedding vector of the i-th sample and the embedding vector of the j-th sample in modality k;

[0093] Based on the inter-modality similarity matrix The cross-modal consistency between different samples is calculated, and a global cross-modal alignment matrix A representing the similarity relationship between each sample in different modalities is constructed. The expression is:

[0094] ,

[0095] in, is the degree of cross-modal alignment between the i-th and j-th samples, and k is the index variable of the modality type;

[0096] Preferably, a global cross-modal alignment matrix A is constructed to reflect the cross-modal correspondence between samples, that is, which text records and which images or video clips may describe the same scene or concept. Such a similarity matrix provides a basis for subsequent feature fusion, because it guides how to weight or pair data of different modalities, thereby retaining the unique information of each modality in the fusion process, and promoting mutual understanding and complementation between modalities, thereby improving the accuracy and depth of overall data analysis;

[0097] The cross-modal attention mechanism is used to dynamically adjust the weights of different modalities in the feature fusion process in the global cross-modal alignment matrix A to strengthen important information and suppress irrelevant parts. The expression of the cross-modal attention mechanism is:

[0098] ,

[0099] in, is the new feature vector of the i-th sample on modality k after adjustment by the attention mechanism, is the sigmoid activation function, is a scalar scaling factor, is the weight matrix in the attention mechanism, is the bias term, For Hadamard;

[0100] Preferably, the introduction of the cross-modal attention mechanism highlights its role in dynamically adjusting modal weights and highlighting key information. The cross-modal feature vector generated by weighted summation not only integrates multi-source information but also retains modal characteristics.

[0101] The embedding vectors processed by the inter-modal similarity matrix, the global cross-modal alignment matrix and the cross-modal attention mechanism are aggregated by modality, and the cross-modal feature vector expression is generated by weighted summation:

[0102] Preferably, the introduction of the cross-modal attention mechanism highlights its role in dynamically adjusting modal weights and highlighting key information. The cross-modal feature vector generated by weighted summation not only integrates multi-source information but also retains modal characteristics;

[0103] The embedding vectors processed by the inter-modal similarity matrix, the global cross-modal alignment matrix and the cross-modal attention mechanism are aggregated by modality, and the cross-modal feature vector expression is generated by weighted summation:

[0104] ,

[0105] in, is the cross-modal feature vector of the i-th sample.

[0106] S3. Input the cross-modal feature vector into the dynamic memory network to dynamically update the memory state.

[0107] Furthermore, the content query function and gating function Perform feature combination, which includes cross-modal feature vectors and the current memory state , input to the memory update mechanism The expression is:

[0108] ,

[0109] ,

[0110] in, is the memory matrix at time step t, To remember, the matrix is ​​d-dimensional multiplied by n is a real matrix of memory units, d is the dimension of the cross-modal feature vector, is the number of memory cells, Combines the symbols for the features, which can be element-wise multiplication (if and are homonymous), used to emphasize those Important and relevant to the current memory state Related parts, thereby achieving dynamic updating of memory;

[0111] It should be noted that in the secure knowledge generation method based on the large language model, the content query function and the gating function are key components of the dynamic memory network update mechanism, which help the model retrieve relevant information from the cross-modal feature vector and control the degree of memory update. The following are typical expressions of these two functions:

[0112] The content query function aims to extract the content from the current cross-modal feature vector Retrieval and memory state Related content features, which are usually designed as a function that can measure the correlation between the two. For each memory unit (or memory vector) and mode k, the content query function The expression is:

[0113] ,

[0114] in, is the weight matrix associated with mode k, used to convert the cross-modal feature vectors Mapped to a feature space that matches the memory state, is the corresponding bias term, where the dot product operation can be a simple inner product or a more complex interaction operation, depending on the design of the model;

[0115] The gating function is used to adjust the degree of memory update and determine how the new information is combined with the original memory state. A common gating mechanism is to use a gating unit (such as the gating mechanism in LSTM or GRU), but in this context, the gating function can be simplified to and memory status To determine the updated weight, the gating function expression is:

[0116] ,

[0117] in, is the gating function of the kth mode, is the gating weight matrix associated with mode k, used to gate the memory state Perform a linear transformation to calculate the gating signal, is the gated bias term corresponding to mode k, used for translation transformation;

[0118] In the update function Before each update, a forget gate is introduced To decide whether to keep or forget old information, the expression is:

[0119] ,

[0120] in, is the weight matrix of the forget gate, is the bias term of the forget gate;

[0121] Preferably, through the softmax function Adjusting attention weights can enhance contextual relevance;

[0122] The current memory state is adjusted by the forget gate to form the update rule expression:

[0123] ,

[0124] in, For time step t through the forget gate The new memory state after adjustment;

[0125] Preferably, the update rule comprehensively considers the newly input cross-modal feature vector and the current memory state, and realizes the refined update of memory through element-level multiplication operation, thereby ensuring the adaptability and accuracy of security knowledge generation;

[0126] Dynamically update the memory state based on the update rules to generate the final dynamically updated memory state, aiming to provide real-time and accurate security policy recommendations. The expression is:

[0127] .

[0128] S4. Based on the large language model, the dynamically updated memory state is used as additional context to generate an enhanced context vector.

[0129] Furthermore, the memory state will be dynamically updated. , mapped to the context vector C adapted to the large language model through linear transformation and nonlinear activation function, the expression is:

[0130] ,

[0131] in, The activation function for the modified linear unit is used to ensure the non-negativity of the output, which helps the model learn more complex patterns. is the mapping matrix, is the bias term of the mapping matrix;

[0132] Preferably, linear transformation and nonlinear activation function are two basic and important components in building a neural network model, which work together to enable the network to learn and express complex input-output mapping relationships;

[0133] Combined with the normalized exponential function Dynamically adjust the attention weights with the context vector C The expression is:

[0134] ,

[0135] in, is the feature vector of the tth time step, is the weight matrix combining the memory state context vector C, is the bias term in the attention mechanism;

[0136] Preferably, the normalized exponential function softmax is combined with the context vector C to dynamically adjust the attention weight , in essence, by converting the model's attention to different pieces of information into the form of probability distribution, it not only ensures the stability and efficiency of attention allocation, but also greatly enhances the focusing ability of model learning and the interpretability of the decision-making process. It is the core strategy for achieving accurate information screening and utilization in complex scenarios;

[0137] Based on attention weight , for the final dynamic update memory state Perform weighted summation to form an enhanced context vector , this vector carries the memory information that has been filtered and nonlinearly transformed, which can be better integrated into the prediction or generation process of the language model, promoting the coherence of context understanding and generation, and enhancing the context vector The expression is: .

[0138] It should be noted that this step achieves efficient encoding from the original memory state to adapt to the context of the large language model through a series of mathematical transformations, especially linear transformations and nonlinear activations. It is a key bridge connecting the memory mechanism and language understanding generation.

[0139] S5. Combine the enhanced context vector with the dynamically updated memory state to generate security knowledge entries.

[0140] Furthermore, the context vector is enhanced by dimension alignment and matching pairs and the final dynamically updated memory state Preprocessing is performed to facilitate subsequent operations. If the two dimensions are different, they are adjusted through linear transformation (such as using a fully connected layer) or feature mapping method to make the dimensions match; Dimension alignment aims to "align" the two vectors in a higher-level sense through mathematical transformation (such as through rotation, scaling, etc.) to promote effective communication of information;

[0141] The context vector and the final dynamically updated memory state , perform weighted summation, and generate the initial fusion vector expression as :

[0142] ,

[0143] in, Update memory status for final dynamic update The weight coefficient of is the context vector The weight coefficient of

[0144] Preferably, Determines the proportion of memory state information in the fusion vector. This coefficient reflects the importance the model attaches to historical information and accumulated knowledge when generating security knowledge. A higher The value means that the model is more inclined to rely on existing long-term memory and previously learned knowledge patterns, which is crucial for maintaining knowledge coherence and leveraging historical experience;

[0145] The influence of immediate context information on the final decision is controlled. The enhanced context vector usually contains the latest features that are closely related to the current situation. When it is high, the model focuses more on considering current environmental changes and the latest inputs, which helps to improve sensitivity and adaptability to immediate security threats;

[0146] In summary, through and The mutual constraints of the two jointly regulate the balance between the model's use of long-term memory and short-term context information, ensuring that the generated security knowledge items not only contain the wisdom accumulated in history, but also reflect the latest security situation in a timely manner, thus improving the timeliness and accuracy of security strategies or analysis;

[0147] The attention mechanism is integrated with the sigmoid function to constrain the range and ensure that the feature weights emphasized by the attention mechanism fall within a reasonable and explainable probability range, thereby optimizing the model performance and output quality. The specific expression is:

[0148] ,

[0149] in, for Relative to Importance adjustment factor;

[0150] according to To dynamically adjust the context vector The weight coefficient , and get the final fusion vector : ;

[0151] The final fusion vector , input to the large language model , the expression of generated security knowledge item y is:

[0152] ,

[0153] in, For large language models The process of generating text based on input information, such as a question, the beginning of a sentence, or an instruction, and then autonomously creating one or more coherent and relevant text responses. This process is not just a simple recall or restatement of known information, but the model uses its learned language knowledge and patterns to creatively construct new and previously unseen text content;

[0154] It should also be noted that by integrating enhanced context vectors and dynamic memory states, not only the high accuracy, timeliness and personalization of security knowledge items are ensured, but also the knowledge structure is optimized, the interactive experience is improved, and the system's adaptive learning ability is enhanced, which comprehensively improves the efficiency and effectiveness of security information processing.

[0155] This embodiment also provides a security knowledge generation system based on a large language model, including a multimodal data acquisition module, a cross-modal attention fusion module, a dynamic knowledge memory update module, and a security knowledge generation module; the multimodal data acquisition module is used to collect multimodal heterogeneous data sets of text records, network traffic logs, image materials and video clips in a network environment; the cross-modal attention fusion module is used to deeply encode the multimodal heterogeneous data sets through a multimodal Transformer encoder, and combine it with a cross-modal attention mechanism to generate a cross-modal feature vector; the dynamic knowledge memory update module is used to input the cross-modal feature vector into a dynamic memory network for dynamic update of the memory state; the security knowledge generation module is used to generate security knowledge entries based on the large language model using the dynamically updated memory state as additional context.

[0156] This embodiment also provides a computer device, which is suitable for the case of a security knowledge generation method based on a large language model, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the security knowledge generation method based on a large language model proposed in the above embodiment.

[0157] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0158] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for generating secure knowledge based on a large language model as proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.

[0159] In summary, the present invention integrates core steps such as multimodal data acquisition, deep coding, cross-modal feature fusion, dynamic memory network update and large language model context enhancement, realizes the efficient and automatic generation of security knowledge items from diversified network environment data, enhances the accuracy and timeliness of threat identification, and provides an intelligent upgrade for network security protection.

[0160] Example 2, referring to Table 1, is the second example of the present invention. To further verify the advancement of the present invention, experimental simulation data of a security knowledge generation method based on a large language model is provided.

[0161] First, in order to verify the effectiveness of the security knowledge generation method based on the large language model of the present invention, a set of comparative experiments including four different scenarios was designed, named scenarios A, B, C, and D. Scenario A represents the common single-modal security knowledge generation method in the prior art, while scenarios B, C, and D represent the application examples of the present invention under different configurations, aiming to highlight the innovation and advantages of cross-modal feature fusion and dynamic memory network for security knowledge generation. The data collection of each scenario covers text records, network traffic logs, image data, and video clips, all of which follow the collection standards specified in the claims, and carry out detailed data cleaning and annotation.

[0162] Scenario A: The traditional method is used to process the data of each modality separately without cross-modal fusion.

[0163] Scenario B: implemented as claimed, but only using a base configuration multimodal Transformer encoder and a simple memory update mechanism.

[0164] Scenario C: Based on Scenario B, a modal similarity function and a global cross-modal alignment matrix are added to optimize cross-modal feature extraction.

[0165] Scenario D: Fully implement all technical features of the present invention, including advanced update strategies for dynamic memory networks and enhanced context vector generation.

[0166] Among them, for scenario D, special attention is paid to the design of the forget gate in the dynamic memory network. By carefully adjusting the forget gate parameters (such as , ), ensuring that memory updates can effectively retain important historical information while flexibly accepting new knowledge, thereby improving the timeliness and accuracy of memory states. In addition, the enhanced context vector generation stage ensures that the generated security knowledge items are not only rich but also highly relevant and accurate through fine-tuning of nonlinear mapping and attention mechanisms.

[0167] The details are shown in the following table:

[0168]

[0169] It can be seen from the above comparison data that with the gradual application of the technical features of the present invention, the performance of the security knowledge generation system has been significantly improved. Compared with scenario A, scenario D has improved the text record accuracy by 6 percentage points, the traffic log recognition rate by 8 percentage points, the image recognition rate and the video comprehension rate by 13 and 17 percentage points respectively, and the security knowledge generation quality score has increased by 1.3 points to 4.5 points, which directly reflects the key role of cross-modal fusion and dynamic memory network in improving the efficiency and quality of security knowledge generation.

[0170] By introducing the modal similarity function and the global cross-modal alignment matrix (the change from scene C to scene D), the image recognition rate and video comprehension rate have been significantly improved, which shows that the system's ability to understand and integrate cross-modal information has been significantly enhanced. In addition, the advanced update strategy of the dynamic memory network enables the system to more effectively learn and memorize security events across time spans, and the generated knowledge items are not only more accurate, but also more forward-looking and comprehensive.

[0171] The present invention also significantly improves the accuracy, breadth and depth of security knowledge generation by integrating technologies such as multimodal Transformer encoder, cross-modal attention mechanism, dynamic memory network, etc. Compared with the existing technology, it shows obvious innovation and advantages, especially in complex and changeable network environments. It can more efficiently generate high-quality security knowledge items, providing strong support for network security protection.

[0172] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A security knowledge generation method based on a large language model, characterized by: include, Collect text records, network traffic logs, image data and video clips in the network environment to form a multimodal heterogeneous data set; deeply encode the multimodal heterogeneous data set through the multimodal Transformer encoder, and combine it with the cross-modal attention mechanism to generate a cross-modal feature vector; Input the cross-modal feature vector into the dynamic memory network to dynamically update the memory state; Based on the large language model, the dynamically updated memory state is used as additional context to generate an enhanced context vector; The dynamically updated memory state based on the large language model is used as additional context, which means: Will eventually dynamically update the memory state , mapped to the context vector C adapted to the large language model through linear transformation and nonlinear activation function, the expression is: ， in, is the rectified linear unit activation function, is the mapping matrix, is the bias term of the mapping matrix; Combined with the normalized exponential function Dynamically adjust the attention weights with the context vector C The expression is: ， in, is the feature vector of the tth time step, is the weight matrix combining the memory state context vector C, is the bias term in the attention mechanism, is the weight matrix in the attention mechanism; Based on attention weight , for the final dynamic update memory state Perform weighted summation to form an enhanced context vector , the expression is: ; The enhanced context vector is combined with the dynamically updated memory state to generate security knowledge items.

2. The method for generating security knowledge based on a large language model according to claim 1, characterized in that: The text records, network traffic logs, image data and video clips in the network environment are collected to form a multimodal heterogeneous data set, and the specific steps are as follows: Text records include text record data regularly collected from system logs, user behavior logs, chat and email records, and public network resource sources; Network traffic logs include network traffic log data using full packet capture and deep packet inspection for network traffic log parsing; Image data includes image data collected from surveillance screenshots, web page screenshots, and graphic verification codes and image attachments; Video clips include video clip data collected from surveillance videos, meeting records, and online live broadcasts and video sharing platforms; The collected text records, network traffic logs, image data and video clip data are cleaned and labeled, and integrated into a multimodal heterogeneous data set.

3. The method for generating security knowledge based on a large language model as claimed in claim 2, characterized in that: The deep encoding of the multimodal heterogeneous dataset by the multimodal Transformer encoder refers to: Use the BERT pre-trained model to encode the text and obtain the context modal vector; After normalizing the traffic size and protocol type in the network traffic log, the traffic features are mapped to the vector space with the same dimension as the text through a fully connected layer to generate a dimensional space modal vector; The ResNet pre-trained model is used to extract feature maps from image data and video clips, and a fixed-length modal vector is obtained through global average pooling. Add position encoding to contextual modal vectors, dimensional space modal vectors, and fixed-length modal vectors to generate embedding vectors for each modality; The embedding vectors of each modality are fused through the embedding space, and the fused multi-modal embedding vector is output; A multi-head self-attention mechanism is applied to learn the features of the fused multimodal embedding vector from different angles, and the features are gradually refined through multiple encoder layers to complete deep encoding.

4. The method for generating security knowledge based on a large language model as claimed in claim 3, characterized in that: The specific steps of generating a cross-modal feature vector are as follows: Based on the deep encoding of multimodal heterogeneous datasets through the multimodal Transformer encoder, the modal similarity function is used to construct the inter-modal similarity matrix expression as follows: ， in, is the similarity score between the i-th and j-th samples on modality k, To balance the cosine similarity and the exponential weight of the Kullback-Leibler divergence The hyperparameters of is a hyperparameter that controls the Kullback-Leibler divergence weight, is the Kullback-Leibler divergence between the embedding vector of the i-th sample and the embedding vector of the j-th sample in modality k; Based on the inter-modality similarity matrix , the expression of constructing the global cross-modal alignment matrix A is: ， in, is the degree of cross-modal alignment between the i-th and j-th samples, and k is the index variable of the modality type; The cross-modal attention mechanism is used to dynamically adjust the weights of different modalities in the feature fusion process in the global cross-modal alignment matrix A. The expression of the cross-modal attention mechanism is: ， in, is the new feature vector of the i-th sample on modality k after adjustment by the attention mechanism, is the sigmoid activation function, is a scalar scaling factor, For Hadamard; The embedding vectors processed by the inter-modal similarity matrix, the global cross-modal alignment matrix and the cross-modal attention mechanism are aggregated by modality, and the cross-modal feature vector expression is generated by weighted summation: ， in, is the cross-modal feature vector of the i-th sample.

5. The method for generating security knowledge based on a large language model as claimed in claim 4, characterized in that: The cross-modal feature vector is input into the dynamic memory network to dynamically update the memory state. The specific steps are as follows: Content query function and gating function Perform feature combination, which includes cross-modal feature vectors and the current memory state , input to the memory update mechanism The expression is: ， ， in, is the memory matrix at time step t, The memory matrix is ​​d-dimensional multiplied by is a real matrix of memory units, d is the dimension of the cross-modal feature vector, is the number of memory cells, Combine symbols for features; In the update function Before each update, a forget gate is introduced The expression is: ， in, is the weight matrix of the forget gate, is the bias term of the forget gate; The current memory state is adjusted by the forget gate to form the update rule expression: ， in, For time step t through the forget gate The new memory state after adjustment; Dynamically update the memory state based on the update rules to generate the final dynamically updated memory state The expression is: .

6. The method for generating security knowledge based on a large language model as claimed in claim 5, characterized in that: The enhanced context vector is combined with the dynamically updated memory state to generate a security knowledge entry, and the specific steps are as follows: Context vectors enhanced by dimension alignment and matching pairs and the final dynamically updated memory state Perform pre-processing; The context vector and the final dynamically updated memory state , perform weighted summation, and generate the initial fusion vector expression as : ， in, Update memory status for final dynamic update The weight coefficient of is the context vector The weight coefficient of The attention mechanism is used to fuse the sigmoid function to constrain the range. The specific expression is: ， in, for Relative to Importance adjustment factor; according to To dynamically adjust the context vector The weight coefficient , and get the final fusion vector : ； The final fusion vector , input to the large language model , the expression of security knowledge item y is generated as: ， in, For large language models The process of generating text based on input information.

7. A security knowledge generation system based on a large language model, based on the security knowledge generation method based on a large language model according to any one of claims 1 to 6, characterized in that: It includes multimodal data acquisition module, cross-modal attention fusion module, dynamic knowledge memory update module, and security knowledge generation module; The multimodal data acquisition module is used to collect multimodal heterogeneous data sets of text records, network traffic logs, image data and video clips in the network environment; The cross-modal attention fusion module is used to deeply encode the multimodal heterogeneous dataset through the multimodal Transformer encoder, and combine it with the cross-modal attention mechanism to generate a cross-modal feature vector; The dynamic knowledge memory update module is used to input the cross-modal feature vector into the dynamic memory network to dynamically update the memory state; The security knowledge generation module is used to generate security knowledge items based on the large language model by using the dynamically updated memory state as additional context.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for generating security knowledge based on a large language model described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for generating security knowledge based on a large language model described in any one of claims 1 to 6 are implemented.

Images