A collaborative enhancement method for APT knowledge graph and large language model

Abstract

The present invention discloses a collaborative enhancement method for APT knowledge graphs and large language models, including the following steps: S1, constructing an APT knowledge graph focusing on the field of network security; S2, designing chain prompts based on user input questions and passing them to the large language model in sequence for step-by-step answers. The large language model uses the knowledge provided by the APT knowledge graph to query and locate the questions; S3, combining the located APT knowledge nodes with the question content input by the user, and enriching the context-aware prompts using strongly related nodes retrieved from the subgraph; S4, the large language model generates a comprehensive answer for the user based on the context-aware prompts. The present invention enhances the semantic understanding, reasoning, and prediction capabilities of the large language model in APT scenarios. The large language model can better analyze and infer attacker behavior and attack paths, improve accuracy in complex network environments, and enhance defense and response capabilities against APT attacks.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to a collaborative enhancement method for APT knowledge graphs and large language models. Background Art

[0002] Advanced persistent threats (APTs), also known as advanced long-term threats, are complex, persistent cyberattacks that pose a major threat to critical government and corporate assets in cyberspace. Due to the stealth and persistence of APT attacks, traditional network detection methods are often unable to effectively identify them.

[0003] Cyber ​​Threat Intelligence (CTI) provides security researchers with an in-depth understanding of APT attacks. By collecting and analyzing threat intelligence, security professionals can identify and understand potential APT threats, including attackers' behavioral patterns, tools and techniques, and target areas. This understanding enables organizations to implement appropriate prevention, detection, and response measures, improving their ability to combat APT attacks.

[0004] Currently, the main challenges facing APT attack detection include the difficulty of detecting advanced intrusion methods and the difficulty of discovering long-term latent and hidden threats. To address these challenges, knowledge graphs can be used to track and analyze APT organizations.

[0005] Knowledge graphs (KGs), as semantic relationship models, organize and represent knowledge in a graphical format. Through knowledge graph technology, various threat information can be structured and associated, making it easier to acquire and analyze threat information. In the field of cybersecurity, knowledge graphs can be used to integrate knowledge about threat evolution, attacker behavior, and vulnerability information to provide a more comprehensive and in-depth understanding of threat intelligence, enabling security researchers to accurately and efficiently obtain the various threat information they need.

[0006] The rise of large language models (LLMs) has become a core driving force behind intelligent knowledge graphs, providing powerful language processing capabilities for the modeling, understanding, and application of knowledge graphs. The key to knowledge graphs lies in accurately extracting relationships between entities and performing reasoning analysis. By learning from large amounts of text data, large language models can capture relational information in context, improve the accuracy of relationship extraction in knowledge graphs, and, to a certain extent, support reasoning about relationships. Large language models can automatically extract entities and relationships from text by processing large corpora, facilitating the construction of knowledge graphs. Furthermore, large language models can help knowledge graphs stay updated and adapt to new contexts and expressions by learning new language expressions, providing new possibilities for processing complex threat intelligence.

[0007] LLMs' ability to learn domain-specific knowledge makes them better suited for building domain-specific knowledge graphs, particularly in the cybersecurity field. By introducing specialized terminology, attack methods, and language styles from the cybersecurity field, LLMs help build a more accurate APT knowledge graph focused on the cybersecurity field. Integrating the APT knowledge graph into the large language model can enhance the contextual understanding and reasoning capabilities of threat intelligence, provide more accurate and customized analysis results, and facilitate in-depth mining of threat information related to APT organizations. The APT knowledge graph based on the large language model can perform targeted threat modeling, better capturing the behavioral patterns, target areas, and attack chains of APT attackers, and helping to improve the identification and prevention of specific threats.

[0008] By combining LLMs with expertise in the APT field, we can break down domain barriers in knowledge graph construction, making the knowledge graph closer to actual threat scenarios and providing security professionals with more accurate and comprehensive information, thereby enhancing the ability to defend and respond to APT attacks.

[0009] The fusion of knowledge graphs and large language models can be achieved through three main paths: knowledge graph-enhanced large language models, large language model-enhanced knowledge graphs, and collaborative large language models and knowledge graphs.

[0010] KG-enhanced LLMs: In this approach, knowledge graphs are used to enhance the training and inference of large language models. Entity and relationship information from knowledge graphs is organically integrated into language models to improve their understanding of context and entity relationships. By providing structured entity relationship information, knowledge graphs enhance language models' capabilities in contextual understanding and relational reasoning. This is particularly true for language generation tasks involving scarce entities and relationships, enabling more accurate and rich text generation.

[0011] LLMs-enhanced KGs: In this approach, large language models are applied to enhance knowledge graphs for tasks such as information extraction, relational reasoning, and entity linking. Language models, trained on large amounts of textual data, provide rich linguistic representations for knowledge graphs. LLMs improve the accuracy of entity and relation extraction in knowledge graphs, particularly in handling ambiguity and linguistic variation. They help more accurately capture contextual information in knowledge graphs and enhance relational reasoning capabilities.

[0012] Collaboration between LLMs and KGs: This approach achieves synergy between knowledge graphs and large language models. Knowledge graphs provide structured information, while large language models process and understand the information in the knowledge graph using natural language methods, mutually reinforcing each other. By combining the structured information of the knowledge graph with the natural language understanding capabilities of large language models, overall contextual awareness and reasoning capabilities are improved. This approach is adaptable to diverse tasks, supporting both querying and reasoning on knowledge graphs and tasks such as natural language generation.

[0013] Large language models, such as GPT-4 and GLM, have achieved remarkable success in the field of natural language processing (NLP), especially in a variety of tasks such as question answering, machine translation, and text generation. However, these models still have limitations when dealing with tasks that contain factual knowledge. For example, they sometimes produce statements containing incorrect facts, a phenomenon known as the "hallucination" problem. For example, when asked "When did Einstein discover gravity?", the model may incorrectly cite facts related to Isaac Newton.

[0014] One solution is to pre-train LLMs using domain-specific data, rather than relying on general text corpora. Models that adopt this approach include SecurityLLM, CySecBERT, SecureBERT, MalBERT, CATBERT, DarkBERT, PubMedBERT, and BioMedGPT. However, pre-training LLMs from scratch is impractical because achieving human-like performance with current LLMs requires significant computational cost and time. Furthermore, no publicly available models support pre-training LLMs in the APT field.

[0015] How to utilize the collaborative work of LLMs and KGs to break the domain barriers in knowledge graph construction, make the knowledge graph closer to the actual threat scenario, provide security professionals with more accurate and comprehensive information, and thus enhance the defense and response capabilities against APT attacks is an urgent problem to be solved. Summary of the Invention

[0016] The technical problem to be solved by the present invention is to address the deficiencies in the above-mentioned existing technologies and provide a collaborative enhancement method for APT knowledge graphs and large language models. By effectively integrating the APT knowledge graph into the large language model, the semantic understanding, reasoning and prediction capabilities of the large language model in APT scenarios are enhanced. The large language model can better analyze and infer attacker behavior and attack paths, improve accuracy in complex network environments, and enhance the defense and response capabilities against APT attacks.

[0017] To solve the above technical problems, the present invention adopts a technical solution: a collaborative enhancement method for APT knowledge graph and large language model, which includes the following steps:

[0018] Step S1: Construct an APT knowledge graph focusing on the field of network security;

[0019] Step S2: Design chain prompts based on the questions input by the user and pass them to the large language model in sequence for step-by-step answers. The large language model uses the knowledge provided by the APT knowledge graph to query and locate the question;

[0020] Step S3: combining the located APT knowledge nodes with the question content input by the user, and using the strongly related nodes retrieved from the subgraph to enrich the context-aware prompts;

[0021] Step S4: The large language model generates a comprehensive answer for the user based on context-aware prompts.

[0022] In the above-mentioned collaborative enhancement method for APT knowledge graph and large language model, the specific process of constructing an APT knowledge graph focusing on the field of network security described in step S1 is as follows:

[0023] Step S101: Collect relevant data in the field of network security and threat intelligence related to APT attacks, and use a public threat intelligence platform to obtain threat information in the field of network security;

[0024] Step S102: De-duplication and filtering are performed on the information obtained from different data sources, and the formats of the information in various data sources are standardized;

[0025] Step S103: Identify the threat entity types in the threat intelligence using named entity recognition technology; extract the relationships between different types of entities from the threat intelligence using relationship extraction technology;

[0026] Step S104: Based on the results of the relationship extraction technology, the attacker entities identified by the named entity recognition technology are linked to the entities in the existing knowledge base to construct the relationship between the entities in the knowledge graph and form an APT knowledge graph.

[0027] In the above-mentioned collaborative enhancement method for APT knowledge graph and large language model, the public threat intelligence platform described in step S101 includes MITRE, ATT&CK, and CVE; the threat information in the network security field described in step S101 includes security reports, weapon tool analysis, and vulnerability information.

[0028] In the above-mentioned collaborative enhancement method for APT knowledge graph and large language model, the threat entity types in the threat intelligence described in step S103 include attackers, attack tools, attack targets, attack methods and vulnerabilities; the relationships between different types of entities in step S103 include the relationship between attackers and attack targets, the relationship between attackers and attack tools, the relationship between attack tools and attack methods, and the relationship between attack tools, attack methods and vulnerabilities, covering all stages of the APT attack life cycle.

[0029] In the above-mentioned collaborative enhancement method for APT knowledge graph and large language model, the chain prompts designed according to the question input by the user in step S2 are sequentially passed to the large language model for step-by-step answers. The specific process of the large language model using the knowledge provided by the APT knowledge graph to query and locate the question is as follows:

[0030] Step S201: Perform named entity recognition on the APT knowledge graph based on the question content input by the user, and extract entities related to the APT knowledge graph;

[0031] Step S202: Divide the user input question into two parts, the first part containing only questions about entities, and the second part containing questions about entities and relationships; locate APT knowledge nodes corresponding to the extracted entities in the APT knowledge graph, wherein the APT knowledge nodes include knowledge nodes that answer questions about entities and knowledge nodes that answer questions about entities and relationships;

[0032] Step S203: Return the query result.

[0033] The above-mentioned collaborative enhancement method for APT knowledge graph and large language model, as described in step S201, performs named entity recognition on the APT knowledge graph for the question content input by the user. When extracting entities related to the APT knowledge graph, zero-sample prompting technology is applied based on the large language model to efficiently extract APT knowledge graph related entities from the question input by the user.

[0034] The above-mentioned collaborative enhancement method for APT knowledge graph and large language model, as described in step S202, when locating the APT knowledge node corresponding to the extracted entity in the APT knowledge graph, design a query statement to return the APT knowledge node details in JSON format, and when locating the knowledge node that answers the question about the entity and relationship, traverse other related nodes of the APT knowledge node corresponding to the entity to obtain the related node subgraph.

[0035] In the above-mentioned collaborative enhancement method for APT knowledge graph and large language model, in step S3, the located APT knowledge node is combined with the question content input by the user, and the context-aware prompt is enriched by using the strongly related nodes retrieved from the subgraph. The subgraph retrieval algorithm is used to enhance the retrieval efficiency and function, and the related nodes within three hops of the APT knowledge node are retrieved in the related node subgraph. This includes guidance on how the large language model answers questions, the user's initial question, and information about the node itself. The specific process is as follows:

[0036] Step S301: Retrieve entities related to the extracted APT knowledge based on the question content input by the user;

[0037] Step S302: Retrieve the related node subgraph containing the knowledge node and the relationship according to the APT knowledge node relationship in the question input by the user;

[0038] Step S303: retrieve and obtain several related node subgraphs containing the above knowledge nodes and relationships, sort them according to the number of related node subgraphs, select the related node subgraph with the highest number of nodes, and search the related node subgraphs for related nodes within three hops of the APT knowledge node.

[0039] Compared with the prior art, the present invention has the following advantages:

[0040] 1. By constructing an APT knowledge graph focused on the field of network security, this invention enables large language models (LLMs) to deeply understand and utilize threat intelligence corpus, thereby improving the efficiency and accuracy of large language models in APT scenarios.

[0041] 2. The knowledge graph node data enhancement scheme of the present invention provides structured and highly relevant information, especially the chain-decomposition prompts Prompt1 and Prompt2, which enable the large language model to more accurately understand the entities, relationships, and context behind the threat. The large model's step-by-step answers to user questions further improve the interpretability of the large language model on the APT knowledge graph, allowing users to more intuitively understand the decision-making process of the large language model, thereby enhancing the credibility and interpretability of the large language model.

[0042] 3. The present invention effectively integrates the APT knowledge graph into the large language model. The target subgraph obtained through subgraph retrieval and the large language model can seamlessly utilize these strongly correlated key nodes and relationship information to enrich contextual prompts, generating accurate and comprehensive answers, thereby enhancing the semantic understanding, reasoning and prediction capabilities of the large language model in APT scenarios. The large language model can better analyze and infer attacker behavior and attack paths, and improve accuracy in complex network environments.

[0043] 4. This invention focuses on the integration of APT knowledge graphs in the field of network security, enabling large language models to better adapt to the professional terminology and context in the field of network security, thereby improving the adaptability of large language models in APT scenarios.

[0044] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0046] like Figure 1 As shown, the collaborative enhancement method for APT knowledge graph and large language model of the present invention includes the following steps:

[0047] Step S1: Construct an APT knowledge graph focusing on the field of network security;

[0048] In this embodiment, the specific process of constructing the APT knowledge graph focusing on the field of network security in step S1 is as follows:

[0049] Step S101: Collect relevant data in the field of network security and threat intelligence related to APT attacks, and use a public threat intelligence platform to obtain threat information in the field of network security;

[0050] In this embodiment, the cybersecurity data collected in step S101 is collected from platforms including blogs and reports. The public threat intelligence platforms mentioned in step S101 include MITRE, ATT&CK, and CVE. The cybersecurity threat information mentioned in step S101 includes security reports, weapon tool analysis, and vulnerability information. This allows for better updating and expansion of the knowledge graph.

[0051] Step S102: De-duplicate and filter the information obtained from different data sources to ensure the accuracy and reliability of the information in the knowledge graph; and standardize the format of the information in various data sources to facilitate subsequent data integration and processing;

[0052] Step S103: Identify the threat entity types in the threat intelligence using Named Entity Recognition (NER) technology; extract the relationships between different types of entities from the threat intelligence using Relation Extraction (RE) technology;

[0053] In this embodiment, the threat entity types in the threat intelligence described in step S103 include attackers, attack tools, attack targets, attack methods and vulnerabilities; the relationships between different types of entities described in step S103 include the relationship between attackers and attack targets, the relationship between attackers and attack tools, the relationship between attack tools and attack methods, and the relationship between attack tools, attack methods and vulnerabilities, covering all stages of the APT attack life cycle.

[0054] Step S104: Based on the results of the relationship extraction technology, the attacker entities identified by the named entity recognition technology are linked to the entities in the existing knowledge base to ensure the consistency of the entities in the knowledge graph, build the relationship between the entities in the knowledge graph, and form an APT knowledge graph.

[0055] Step S2: Design chain prompts based on the questions input by the user and pass them to the large language model in sequence for step-by-step answers. The large language model uses the knowledge provided by the APT knowledge graph to query and locate the question;

[0056] In this embodiment, the chain prompts (i.e., Prompt1 and Prompt2) designed according to the question input by the user in step S2 are sequentially passed to the large language model for step-by-step answers. The specific process of the large language model querying and locating the question using the knowledge provided by the APT knowledge graph is as follows:

[0057] Step S201: Perform named entity recognition on the APT knowledge graph based on the question content input by the user, and extract entities related to the APT knowledge graph;

[0058] In this embodiment, in step S201, named entity recognition of the APT knowledge graph is performed on the question content input by the user. When extracting entities related to the APT knowledge graph, zero-shot prompting technology is applied based on the large language model to efficiently extract entities related to the APT knowledge graph from the question input by the user.

[0059] In specific implementation, the large language model is the GPT-3.5-Turbo model.

[0060] Step S202: Divide the user input question into two parts, the first part containing only questions about entities, and the second part containing questions about entities and relationships; locate APT knowledge nodes corresponding to the extracted entities in the APT knowledge graph, wherein the APT knowledge nodes include knowledge nodes that answer questions about entities and knowledge nodes that answer questions about entities and relationships;

[0061] Step S203: Return the query result.

[0062] In this embodiment, when locating the APT knowledge node corresponding to the extracted entity in the APT knowledge graph as described in step S202, a query statement is designed to return the APT knowledge node details in JSON format. When locating the knowledge node that answers the question about the entity and relationship, other related nodes of the APT knowledge node corresponding to the entity are traversed to obtain a related node subgraph.

[0063] For example, the query node statement is:

[0064] 'MATCH (m:Person{name:'Alice'})-[r]-(n:Person{name:'Bob'})RETURN r;'.

[0065] Step S3: combining the located APT knowledge nodes with the question content input by the user, and using the strongly related nodes retrieved from the subgraph to enrich the “context-aware prompts”;

[0066] In this embodiment, in step S3, when combining the located APT knowledge nodes with the question content input by the user and enriching the context-aware prompts with strongly related nodes retrieved from the subgraph, the subgraph retrieval algorithm is used to enhance the retrieval efficiency and function, and the related nodes within three hops of the APT knowledge node are retrieved in the related node subgraph, which includes guidance on how the large language model answers questions, the user's initial question, and information about the node itself. The specific process is as follows:

[0067] Step S301: Retrieve entities related to the extracted APT knowledge based on the question content input by the user;

[0068] Step S302: Retrieve the related node subgraph containing the knowledge node and the relationship according to the APT knowledge node relationship in the question input by the user;

[0069] Step S303: retrieve and obtain several related node subgraphs containing the above knowledge nodes and relationships, sort them according to the number of related node subgraphs, select the related node subgraph with the highest number of nodes, and search the related node subgraphs for related nodes within three hops of the APT knowledge node.

[0070] For example, when a user asks the big model: "Can you describe the capability level of the APT33 organization?", the "context-aware prompt" is as follows: "I will give you a question or instruction. Your goal is to answer my question or complete my instruction. My question or instruction is: 'Can you describe the capability level of the APT33 organization?' It is possible that this question or instruction, or part of it, requires relevant information to be extracted from the data to provide a satisfactory answer or complete the task. Therefore, the necessary information or data is provided below as the background for solving the problem or completing the instruction. You will write a comprehensive answer to this question or instruction. Now, use the above information + the nodes queried in the APT knowledge graph and their relationship attribute information to construct a comprehensive answer."

[0071] Step S4: The large language model generates a comprehensive answer for the user based on the “context-aware prompts”, enabling the large language model to answer the questions raised by the user in a more accurate manner.

[0072] In summary, based on the characteristics of APT attacks and related threat intelligence, the present invention has developed effective text mining and information extraction technologies to process unstructured information in threat intelligence corpus, filter noise, extract key information, and construct an APT knowledge graph in the field of network security; studied the fusion strategy of knowledge graph and large language model, designed effective data structure and model architecture, and realized the organic integration of information in APT knowledge graph into large language model, thereby improving the deep understanding and reasoning ability of large language model for threat intelligence, making the decision-making process of large language model enhanced with APT knowledge graph node data more transparent and explainable, and enhancing users' trust and understanding of the output of large language model.

[0073] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0077] The foregoing descriptions of specific exemplary embodiments of the present invention are for purposes of illustration and description. These descriptions are not intended to limit the invention to the precise forms disclosed, and it is apparent that many variations and modifications are possible in light of the foregoing teachings. The exemplary embodiments have been selected and described for the purpose of explaining the specific principles of the invention and their practical application, thereby enabling those skilled in the art to realize and utilize a variety of exemplary embodiments of the invention and various options and modifications. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A collaborative enhancement method for APT knowledge graph and large language model, characterized by: The method comprises the following steps: Step S1: Construct an APT knowledge graph focusing on the field of network security; The specific process of constructing the APT knowledge graph focusing on the field of network security described in step S1 is as follows: Step S101: Collect relevant data in the field of network security and threat intelligence related to APT attacks, and use a public threat intelligence platform to obtain threat information in the field of network security; The public threat intelligence platforms mentioned in step S101 include MITRE, ATT&CK, and CVE; the threat information in the field of network security mentioned in step S101 includes security reports, weapon tool analysis, and vulnerability information; Step S102: De-duplication and filtering are performed on the information obtained from different data sources, and the formats of the information in various data sources are standardized; Step S103: Identify the threat entity types in the threat intelligence using named entity recognition technology; extract the relationships between different types of entities from the threat intelligence using relationship extraction technology; The threat entity types in the threat intelligence described in step S103 include attackers, attack tools, attack targets, attack methods, and vulnerabilities. The relationships between different types of entities in step S103 include the relationship between attackers and attack targets, the relationship between attackers and attack tools, the relationship between attack tools and attack methods, and the relationship between attack tools, attack methods, and vulnerabilities, covering all stages of the APT attack lifecycle. Step S104: Based on the results of the relationship extraction technology, the attacker entities identified by the named entity recognition technology are linked with the entities in the existing knowledge base to construct the relationship between the entities in the knowledge graph and form an APT knowledge graph; Step S2: Design chain prompts based on the questions input by the user and pass them to the large language model in sequence for step-by-step answers. The large language model uses the knowledge provided by the APT knowledge graph to query and locate the question; In step S2, the chain prompts are designed based on the questions input by the user and are passed to the large language model in sequence for step-by-step answers. The specific process of the large language model using the knowledge provided by the APT knowledge graph to query and locate the question is as follows: Step S201: Perform named entity recognition on the APT knowledge graph based on the question content input by the user, and extract entities related to the APT knowledge graph; Step S202: Divide the user input question into two parts, the first part containing only questions about entities, and the second part containing questions about entities and relationships; locate APT knowledge nodes corresponding to the extracted entities in the APT knowledge graph, wherein the APT knowledge nodes include knowledge nodes that answer questions about entities and knowledge nodes that answer questions about entities and relationships; Step S203: Return the query result; Step S3: combining the located APT knowledge nodes with the question content input by the user, and using the strongly related nodes retrieved from the subgraph to enrich the context-aware prompts; In step S3, when combining the located APT knowledge nodes with the question content input by the user and enriching the context-aware prompts with strongly related nodes retrieved from the subgraph, the subgraph retrieval algorithm is used to enhance the retrieval efficiency and function. The subgraph of related nodes is used to retrieve related nodes within three hops of the APT knowledge node, which includes guidance on how the large language model answers questions, the user's initial question, and information about the node itself. The specific process is as follows: Step S301: Retrieve entities related to the extracted APT knowledge based on the question content input by the user; Step S302: Retrieve the related node subgraph containing the knowledge node and the relationship according to the APT knowledge node relationship in the question input by the user; Step S303: retrieve and obtain several related node subgraphs containing the above-mentioned knowledge nodes and relationships, sort them according to the number of related node subgraphs, select the related node subgraph with the largest number of nodes, and search the related node subgraphs for related nodes within three hops of the APT knowledge node; Step S4: The large language model generates a comprehensive answer for the user based on context-aware prompts.

2. A collaborative enhancement method for APT knowledge graphs and large language models according to claim 1, characterized in that: In step S201, named entity recognition of the APT knowledge graph is performed on the question content input by the user. When extracting entities related to the APT knowledge graph, zero-sample prompting technology is applied based on the large language model to efficiently extract entities related to the APT knowledge graph from the question input by the user.

3. A collaborative enhancement method for APT knowledge graphs and large language models according to claim 1, characterized in that: When locating the APT knowledge node corresponding to the extracted entity in the APT knowledge graph as described in step S202, a query statement is designed to return the APT knowledge node details in JSON format. When locating the knowledge node that answers the question about the entity and relationship, other related nodes of the APT knowledge node corresponding to the entity are traversed to obtain the related node subgraph.

Images