Host security rule determination method and apparatus based on generative large language model

Abstract

The application discloses a host security rule determination method and device based on a generative large language model, relates to the fields of information security and artificial intelligence, and comprises the following steps: acquiring an initial knowledge graph template, wherein the initial knowledge graph template is used for describing host attack behaviors to be detected; performing content filling on the initial knowledge graph template by using a generative large language model to obtain a target knowledge graph, wherein the target knowledge graph at least includes at least one piece of host attack behavior information generated by the generative large language model based on the initial knowledge graph template; and determining a host security rule based on the at least one piece of host attack behavior information in the target knowledge graph. The application solves the technical problem that it is difficult to generate a host security rule with high accuracy in the prior art due to poor content accuracy of a large language model.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and artificial intelligence, in particular, to a host security rule determination method and device based on a generative large language model. BACKGROUND

[0002] The detection of threat attacks requires accurate and low false alarm host security rules, and the generation of host security rules requires extracting knowledge from a large number of attack instances and generalizing it into detection patterns expressed in a certain form of language, so that the detection engine can use the host security rules to detect threat attacks.

[0003] At present, the extraction of host security rules is usually through knowledge extraction by machine learning models or summarized by expert experience, and there is no related technology to use large language models to extract and summarize host security rules.

[0004] In addition, since the current large language model (LLM, Large Language Model) has the problem of knowledge extraction divergence when extracting knowledge, it cannot meet the needs of some precise and professional fields, which also leads to the difficulty of effectively applying large language models to the extraction of host security rules. Even if it is forcibly applied, there will be the technical problem of low accuracy of the generated host security rules.

[0005] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0006] The present application provides a host security rule determination method and device based on a generative large language model, to at least solve the technical problem that it is difficult to generate host security rules with high accuracy due to the poor accuracy of the content extracted by the large language model in the prior art.

[0007] According to one aspect of the present application, a host security rule determination method based on a generative large language model is provided, comprising: obtaining an initial knowledge graph template, wherein the initial knowledge graph template is used to describe the host attack behavior to be detected; filling the content of the initial knowledge graph template by the generative large language model to obtain a target knowledge graph, wherein the target knowledge graph at least includes at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template; determining the host security rule based on the at least one host attack behavior information in the target knowledge graph.

[0008] Optionally, the initial knowledge graph template comprises at least one transformation structure and at least one prompt information and a restriction condition, wherein the different transformation structures represent different implementation manners of the host attack behavior, and the at least one prompt information and the restriction condition are used to prohibit the generative large language model from generating information irrelevant to the host attack behavior described in the initial knowledge graph template.

[0009] Optionally, the host security rule determination method based on the generative large language model further comprises: creating system prompt information and system restriction conditions of the generative large language model, wherein the system prompt information and the system restriction conditions are used to control the content generation manner of the generative large language model; merging the initial knowledge graph template with the system prompt information and the system restriction conditions to obtain model input prompt information; inputting the model input prompt information and the text recording the host security event into the generative large language model, extracting content from the text according to the model input prompt information through the generative large language model, and filling the extracted content into the initial knowledge graph template to obtain a target knowledge graph.

[0010] Optionally, the host security rule determination method based on the generative large language model further comprises: when the number of texts is N, inputting the model input prompt information and each of the N texts into the generative large language model, and extracting content from each text according to the model input prompt information through the generative large language model; and filling the extracted content from each text into the initial knowledge graph template to obtain a target knowledge graph corresponding to each text.

[0011] Optionally, the host security rule determination method based on the generative large language model further comprises: when the number of texts is N, inputting the model input prompt information and the Ith text of the N texts into the generative large language model, and extracting content from the Ith text according to the model input prompt information through the generative large language model, wherein I is a positive integer less than or equal to N; filling the extracted content from the Ith text into the initial knowledge graph template to obtain a target knowledge graph corresponding to the Ith text; inputting the target knowledge graph corresponding to the Ith text and the Jth text of the N texts into the generative large language model, and extracting content from the Jth text according to the target knowledge graph corresponding to the Ith text through the generative large language model, wherein the Jth text is different from the Ith text; and filling the extracted content from the Jth text into the target knowledge graph corresponding to the Ith text to obtain a target knowledge graph corresponding to the Ith text and the Jth text.

[0012] Optionally, the method for determining host security rules based on a generative large language model further comprises: obtaining positive feedback prompt information or negative feedback prompt information, wherein the positive feedback prompt information is used to control the generative large language model to extract content from the Jth text that has a target knowledge graph relevance coefficient corresponding to the Ith text greater than a first preset threshold, and the negative feedback prompt information is used to control the generative large language model to extract content from the Jth text that has a target knowledge graph relevance coefficient corresponding to the Ith text less than a second preset threshold; and extracting content from the Jth text according to the target knowledge graph corresponding to the Ith text by the generative large language model based on the positive feedback prompt information or the negative feedback prompt information.

[0013] Optionally, the method for determining host security rules based on a generative large language model further comprises: obtaining a graph similarity between the target knowledge graph corresponding to the Ith text and the target knowledge graph corresponding to the Ith and Jth texts after filling the extracted content from the Jth text into the target knowledge graph corresponding to the Ith text to obtain the target knowledge graph corresponding to the Ith and Jth texts; taking the host security rules extracted based on the target knowledge graph corresponding to the Ith text as a first rule; taking the host security rules extracted based on the target knowledge graph corresponding to the Ith and Jth texts as a second rule; obtaining a rule similarity between the first rule and the second rule; and determining whether to extract content from other texts according to the target knowledge graph corresponding to the Ith and Jth texts based on the graph similarity and / or the rule similarity, wherein the other texts are texts other than the Ith and Jth texts in the N texts.

[0014] Optionally, the method for determining host security rules based on a generative large language model further comprises: performing clustering operation on the at least one host attack behavior information to obtain a clustering result; and performing generalization operation on the clustering result to obtain the host security rules.

[0015] According to another aspect of the present application, a device for determining host security rules based on a generative large language model is also provided, wherein the device comprises: an obtaining unit configured to obtain an initial knowledge graph template, wherein the initial knowledge graph template is used to describe a host attack behavior to be detected; a target knowledge graph determining unit configured to perform content filling on the initial knowledge graph template by a generative large language model to obtain a target knowledge graph, wherein the target knowledge graph comprises at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template; and a host security rule determining unit configured to determine host security rules based on the at least one host attack behavior information in the target knowledge graph.

[0016] According to another aspect of the present application, a computer readable storage medium is also provided, wherein the computer readable storage medium stores a computer program, and the computer program is configured to perform the host security rule determination method based on the generative large language model when executed.

[0017] In the present application, the host attack behavior information is generated by guiding the generative large language model through the initial knowledge graph template. First, an initial knowledge graph template is obtained, wherein the initial knowledge graph template is used to describe the host attack behavior to be detected. Then, the initial knowledge graph template is filled with content by the generative large language model to obtain a target knowledge graph, wherein the target knowledge graph at least includes at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template. Finally, the host security rule is determined based on the at least one host attack behavior information in the target knowledge graph.

[0018] From the above, the present application proposes a way to limit the output content of the generative large language model through the initial knowledge graph template to improve the content generation quality and reliability of the generative large language model. The specific initial knowledge graph template is used to describe the specific host attack technology and host attack tactic behavior to be detected. Therefore, by adding these specific initial knowledge graph templates to the input of the generative large language model, the output format and content of the generative large language model can be constrained to meet the demand of generating host security rules. In other words, the generative large language model can generate more relevant text information for the host attack behavior to be detected according to the provided initial knowledge graph template, thereby realizing the technical effect of effectively applying the generative large language model to obtain accurate host security rules, and further solving the technical problem that it is difficult to generate host security rules with high accuracy due to the poor accuracy of the content extracted by the large language model in the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional host security rule determination method based on a generative large language model according to an embodiment of the present application;

[0021] Figure 2 is a structural schematic diagram of a rule extraction system according to an embodiment of the present application;

[0022] Figure 3is another flowchart for processing text by model input prompt information according to an embodiment of the application;

[0023] Figure 4 is a schematic diagram of an optional host security rule determination device based on a generative large language model according to an embodiment of the application;

[0024] Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0025] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0027] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected by the present application are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal. For example, the system and related users or agencies are provided with an interface, and before obtaining the relevant information, the interface needs to send a request to the aforementioned user or agency, and after receiving the consent information feedback from the aforementioned user or agency, the relevant information is obtained.

[0028] According to an embodiment of the present application, an embodiment of a method for determining host security rules based on a generative large language model is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown.

[0029] Figure 1 is a flowchart of an optional method for determining host security rules based on a generative large language model according to an embodiment of the present application, as shown in Figure 1 , the method comprises the following steps:

[0030] Step S101, obtaining an initial knowledge graph template.

[0031] In step S101, the initial knowledge graph template is used to describe the host attack behavior to be detected. The initial knowledge graph template can describe one or more host attack behaviors.

[0032] In an optional embodiment, a host security rule extraction system (hereinafter referred to as a rule extraction system) can be used as the execution subject of the method for determining host security rules based on a generative large language model according to an embodiment of the present application. The rule extraction system can be a software system or a combination of software and hardware embedded system.

[0033] Optionally, Figure 2 is a structural diagram of a rule extraction system according to an embodiment of the present application, as shown in Figure 2 , the rule extraction system can obtain a security attack report from a CTI (Cyber Threat Intelligence, threat intelligence) platform, and then preprocess the security attack report to extract report classification metadata. By preprocessing the security attack report, a text file for input to the generative large language model can be obtained.

[0034] Optionally, as shown in Figure 2 , the rule extraction system can define the architecture diagram of the knowledge graph, the node type, the relationship between the nodes (i.e., the type of edge), and the attributes of the nodes according to the preset attack technology knowledge framework. In other words, the rule extraction system can use the attack technology definition method and description method in the preset attack technology knowledge framework to create an attack technology knowledge graph initial template (i.e., the initial knowledge graph template described above). The attack technology knowledge graph template can be described using languages such as JSON, YAML, etc.

[0035] It should be noted that the above-mentioned preset attack technology knowledge framework is a framework for describing and classifying host threat behaviors. The framework provides a structured way to understand the tactics, techniques, and methods that attackers can use, and how these techniques are associated with different stages of the attack lifecycle. The attack techniques and attack tactics described in this knowledge framework become practical standards for threat attack detection.

[0036] In step S102, the initial knowledge graph template is filled with content by the generative large language model to obtain a target knowledge graph.

[0037] In step S102, the target knowledge graph includes at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template.

[0038] Optionally, the rule extraction system can also use the initial knowledge graph template as a restriction condition and prompt information when the generative large language model generates text content, so as to control the generative large language model to generate as much host attack behavior information as possible related to the initial knowledge graph template, thereby solving the technical problem that the generative large language model generates a large amount of information unrelated to the generated host security rules.

[0039] It should be noted that generating host security rules first requires knowledge of security attack techniques and tactics. These knowledge can be represented by knowledge graph in graph structure, wherein the nodes in the knowledge graph represent the entities involved in different attack techniques, and the edges represent the relationships between these entities. For example, describing a certain specific attack technique such as "malware" or "privilege escalation", the node can be the process or file entity in the attack. And the edge can represent the association between these entities, such as a process can create a malicious child process to perform a privilege escalation attack.

[0040] In addition, through the way of knowledge graph, the implementation of security attack techniques can be described more clearly, helping security experts better understand the behavior patterns of attackers, thereby improving the effectiveness of defense measures. The extraction of relevant knowledge from text reports can be achieved through natural language processing techniques, such as using text analysis and information extraction techniques to identify instances of attack technique implementation methods and entity relationships mentioned in the report, and then mapping them to nodes and edges in the knowledge graph.

[0041] In summary, since the knowledge graph is more intuitive and the logic expression is more clear, the present application adopts the method of filling the initial knowledge graph template with content by the generative large language model, and records at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template in the target knowledge graph.

[0042] In an alternative embodiment, the automatic conversion of the textual description in the security attack report into a knowledge graph can also be achieved through the following steps:

[0043] Text parsing: Use natural language processing techniques to parse the security attack report and extract key information such as attack techniques, attacker behavior descriptions, etc.

[0044] Entity recognition: Use named entity recognition techniques to identify key entities in the text such as attack techniques, attacker behavior, etc. These entities can be attack technique names, attacker behavior descriptions, etc.

[0045] Relationship extraction: Use relationship extraction techniques to identify the relationships between entities in the text, such as the association between attack techniques and entities in the implementation, the relationship between attack techniques and attacker behavior, etc.

[0046] Knowledge graph construction: Map the identified entities and relationships to nodes and edges in the knowledge graph to construct a knowledge graph representing attack techniques.

[0047] Visual display: Use graphical visualization tools to display the constructed knowledge graph to allow users to more intuitively understand the relationships between attack techniques.

[0048] Among them, the above steps need to be combined with various natural language processing techniques and knowledge graph construction techniques, such as using deep learning models for text parsing and entity recognition, using graph databases to construct knowledge graphs, and combining visualization tools to display the results.

[0049] The preferred method of generating a knowledge graph using a generative large language model in this application can greatly simplify the above steps. By inputting the attack report text and knowledge extraction prompts into the generative large language model, the required knowledge graph can be generated, and even the required structured data can be visualized. At the same time, by using an initial knowledge graph template to control the generated content of the generative large language model, the application can also solve the problems of irrelevant data generated by the generative large language model, excessive divergence of knowledge that cannot meet specific needs, and the creation of data without basis.

[0050] Step S103, determining the host security rule based on at least one host attack behavior information in the target knowledge graph.

[0051] Optionally, the rule extraction system can perform clustering operations on the at least one host attack behavior information to obtain clustering results, and then perform generalization operations on the clustering results to obtain the host security rule.

[0052] Optionally, a clustering operation is used to cluster the at least one host attack behavior information in the target knowledge graph into a plurality of groups, wherein the host attack behavior information belonging to the same group corresponds to the same entity, and the host attack behavior information belonging to different groups corresponds to different entities.

[0053] Optionally, the host security rule is generated by performing a generalization operation on the host attack behavior information in each group.

[0054] Based on the above steps S101 to S103, in the present application, the host attack behavior information is generated by using the initial knowledge graph template to guide the generation of the large language model. First, an initial knowledge graph template is obtained, wherein the initial knowledge graph template is used to describe the host attack behavior to be detected. Then, the initial knowledge graph template is filled with content by the large language model to obtain a target knowledge graph, wherein the target knowledge graph at least includes at least one host attack behavior information generated by the large language model based on the initial knowledge graph template. Finally, the host security rule is determined based on the at least one host attack behavior information in the target knowledge graph.

[0055] From the above content, the present application proposes a way to limit the output content of the large language model by using the initial knowledge graph template, to improve the content generation quality and reliability of the large language model. The specific initial knowledge graph template is used to describe the specific host attack technology and host attack tactic behavior to be detected. Therefore, by adding these specific initial knowledge graph templates to the input of the large language model, the output format and content of the large language model can be constrained, which is used to meet the demand of generating host security rules. In other words, the large language model can generate more relevant text information for the host attack behavior to be detected according to the provided initial knowledge graph template, thereby realizing the technical effect of effectively applying the large language model to obtain accurate host security rules, and further solving the technical problem that it is difficult to generate host security rules with high accuracy due to the poor accuracy of the content extracted by the large language model in the prior art.

[0056] In an optional embodiment, the initial knowledge graph template includes at least one transformation structure and at least one prompt information and restriction condition, wherein different transformation structures represent different implementation manners of the host attack behavior, and the at least one prompt information and restriction condition is used to control the large language model to prohibit generating information irrelevant to the host attack behavior described in the initial knowledge graph template.

[0057] Optionally, according to different attack technology implementation methods, the initial knowledge graph template can be used to describe at least one host attack behavior, wherein each host attack behavior can have one or more variant structures. In addition, for any one host attack behavior, a variant structure of the host attack behavior represents an implementation (i.e., a behavior pattern) of the host attack behavior. For example, for the host attack behavior W, the initial knowledge graph template can describe the host attack behavior by two nodes, namely node A and node B, wherein the entity corresponding to node A is process 1, and the entity corresponding to node B is a file. Assuming that the file can be a video file, an image file, an audio file, or a text file, the initial graph template can design four variant structures for the host attack behavior W, variant structure 1 represents the relationship between process 1 and a video file; variant structure 2 represents the relationship between process 1 and an image file; variant structure 3 represents the relationship between process 1 and an audio file; and variant structure 4 represents the relationship between process 1 and a text file.

[0058] In addition, the initial knowledge graph template also includes prompt information and restriction conditions with host security field professional knowledge for nodes and edges, wherein the prompt information and the restriction conditions are used to prohibit the generative large language model from generating information irrelevant to the host attack behavior described in the initial knowledge graph template.

[0059] It should be noted that the at least one variant structure included in the initial knowledge graph template can achieve the technical effect of inducing as many potential host attack behaviors that need to be detected as possible, and the prompt information and the restriction conditions in the initial knowledge graph template can control the generative large language model to prohibit the generation of information irrelevant to the host attack behavior described in the initial knowledge graph template, thereby avoiding the problem of the generative large language model generating information irrelevant to the host attack behavior.

[0060] In an optional embodiment, the rule extraction system can create system prompt information and system restriction conditions of the generative large language model, wherein the system prompt information and the system restriction conditions are used to control the content generation manner of the generative large language model. Subsequently, the rule extraction system merges and processes the initial knowledge graph template and the system prompt information and the system restriction conditions to obtain model input prompt information. Finally, the rule extraction system inputs the model input prompt information and the text recording the host security event into the generative large language model, extracts content from the text according to the model input prompt information by the generative large language model, and fills the extracted content into the initial knowledge graph template to obtain a target knowledge graph.

[0061] Optionally, in addition to setting prompt information and restriction conditions in the initial knowledge graph template to control the generative large language model to prohibit generating information irrelevant to the host attack behavior described in the initial knowledge graph template, the rule extraction system can also create system prompt information and system restriction conditions (such as limiting the number of words, length, and banned words of the content generated by the large language model, etc.) for the generative large language model, wherein the system prompt information and system restriction conditions are used to control the content generation manner of the generative large language model.

[0062] Optionally, the purpose of the system prompt information and system restriction conditions is also to limit the self-play of the large language model (LLM) in the natural language processing process. In addition to setting system prompt information and system restriction conditions, the following methods can also be used to control the content generation manner of the generative large language model in the embodiments of the present application:

[0063] Fine-tuning the model: Fine-tune the model using data in a specific domain to make it more focused on knowledge in that specific domain and reduce the generalization ability of the model.

[0064] Regularization of the large language model: Use regularization techniques such as Dropout, weight decay, etc. during training to reduce the overfitting tendency of the model.

[0065] Setting the generation temperature: Adjust the generation temperature parameter to control the diversity of the generated text and avoid generating too strange or unreasonable text.

[0066] Manual supervision and filtering: After generating the text, use manual supervision and filtering to check and correct unreasonable generation results.

[0067] The above methods can help limit the self-play of the large language model and make it generate more reasonable and expected text.

[0068] Finally, after creating the system prompt information and system restriction conditions for the generative large language model, the initial knowledge graph template and the system prompt information and system restriction conditions can be merged to obtain model input prompt information, and then the model input prompt information and the text recording the host security event are input into the generative large language model. The generative large language model extracts content from the text according to the model input prompt information and fills the extracted content into the initial knowledge graph template to obtain the target knowledge graph.

[0069] By setting system prompt information and system restriction conditions for the generative large language model, the content generation manner of the generative large language model can be controlled from the model level, and in combination with the restriction conditions of the initial knowledge graph template, it can ensure that the generative large language model generates a sufficiently accurate target knowledge graph.

[0070] In an alternative embodiment, as shown in Figure 2 After the generative large language model LLM completes the knowledge extraction operation and obtains the target knowledge graph, the user can review the target knowledge graph through the rule extraction system. For the target knowledge graph that passes the review, it can be stored in the CTI knowledge base. Subsequently, the user can convert the host security rules based on the template detection knowledge through the rule extraction system, and review the converted host security rules. After the host security rules that pass the review are published, the rule engine in the threat detection engine can call the published rules to perform security detection on the host.

[0071] In addition, as shown in Figure 2 The rule extraction system further includes a storage module, a process implementation module, a user interface, an algorithm interface, and a rule verification and publishing module.

[0072] In an alternative embodiment, when there are N texts for recording host security events, the rule extraction system can input the model input prompt information and each of the N texts into the generative large language model respectively, extract content from each text according to the model input prompt information through the generative large language model, and then fill the extracted content from each text into the initial knowledge graph template respectively to obtain a target knowledge graph corresponding to each text.

[0073] Alternatively, in the embodiments of the present application, a parallel text processing method is proposed, that is, after obtaining the model input prompt information, the N texts are respectively combined with the model input prompt information and input into the generative large language model separately, so that the generative large language model extracts content from each text according to the model input prompt information to obtain a target knowledge graph corresponding to each text, and finally N target knowledge graphs are obtained.

[0074] For example, assuming that there are three texts, namely text Y1, text Y2, and text Y3, text Y1 and the model input prompt information are input into the generative large language model, content is extracted from text Y1 according to the model input prompt information by the generative large language model, and a target knowledge graph corresponding to text Y1 (assuming U1) is obtained. Text Y2 and the model input prompt information are input into the generative large language model, content is extracted from text Y2 according to the model input prompt information by the generative large language model, and a target knowledge graph corresponding to text Y2 (assuming U2) is obtained. Text Y3 and the model input prompt information are input into the generative large language model, content is extracted from text Y3 according to the model input prompt information by the generative large language model, and a target knowledge graph corresponding to text Y3 (assuming U3) is obtained.

[0075] From the above, through the above text extraction manner, content related to the model input prompt information can be extracted from each text under the limitation of the model input prompt information, not only the problem of generating information unrelated to the model input prompt information can be avoided, but also standardized processing of each text can be ensured (because each text is processed based on the same model input prompt information), facilitating subsequent evaluation of the processing result of each text.

[0076] In an alternative embodiment, Figure 3 is another flowchart for processing text through a model input prompt information according to an embodiment of the present application, as shown in Figure 3 includes the following steps:

[0077] Step S301, when the number of texts is N, input the model input prompt information and the Ith text of the N texts into the generative large language model, and extract content from the Ith text according to the model input prompt information through the generative large language model, wherein I is a positive integer less than or equal to N.

[0078] Step S302, fill the extracted content from the Ith text into the initial knowledge graph template to obtain the target knowledge graph corresponding to the Ith text.

[0079] Step S303, input the target knowledge graph corresponding to the Ith text and the Jth text of the N texts into the generative large language model, and extract content from the Jth text according to the target knowledge graph corresponding to the Ith text through the generative large language model, wherein the Jth text is different from the Ith text.

[0080] Step S304, fill the extracted content from the Jth text into the target knowledge graph corresponding to the Ith text to obtain the target knowledge graph corresponding to the Ith text and the Jth text.

[0081] Alternatively, in an embodiment of the present application, a snowball type target knowledge graph generation method, or a snowball type text processing method, is also provided, that is, first, extract content from the Ith text according to the model input prompt information through the generative large language model, fill the extracted content from the Ith text into the initial knowledge graph template to obtain the target knowledge graph corresponding to the Ith text, wherein the Ith text is any one of the N texts. Then, on the basis of the target knowledge graph corresponding to the Ith text, use the target knowledge graph corresponding to the Ith text to process the Jth text in combination with the generative large language model to obtain the target knowledge graph corresponding to the Ith text and the Jth text, wherein the Jth text is a text other than the Ith text in the N texts.

[0082] It should be noted that the rule extraction system can also continue to extract the content of the text by the generative large language model according to the target knowledge graph corresponding to the Jth text and the Ith text, and update the target knowledge graph, and so on, until the final target knowledge graph corresponding to multiple texts is generated.

[0083] It should be noted that the advantage of the above snowball type target knowledge graph is that the content of the text can be continuously extracted according to the latest target knowledge graph. For example, based on the target knowledge graph corresponding to the Ith text, the target knowledge graph corresponding to the Jth text and the Ith text is obtained by using the target knowledge graph corresponding to the Ith text to process the Jth text in combination with the generative large language model. In this process, since the target knowledge graph corresponding to the Ith text is the knowledge graph obtained by filling the content extracted from the Ith text into the initial knowledge graph template, the knowledge graph not only includes the information of the initial knowledge graph template, but also includes the content information in the Ith text, and these information is very valuable for extracting host attack behavior information. Therefore, the target knowledge graph corresponding to the Ith text and the Jth text of the N texts are input into the generative large language model, and the content is extracted from the Jth text according to the target knowledge graph corresponding to the Ith text by the generative large language model, so that the large language model can more accurately extract the content in the Jth text, and a more accurate target knowledge graph can be generated.

[0084] In an optional embodiment, in the process of extracting content from the Jth text according to the target knowledge graph corresponding to the Ith text by the generative large language model, the rule extraction system can also obtain positive feedback prompt information or negative feedback prompt information, wherein the positive feedback prompt information is used to control the generative large language model to extract content from the Jth text related to the target knowledge graph corresponding to the Ith text, and the negative feedback prompt information is used to control the generative large language model to extract content from the Jth text related to the target knowledge graph corresponding to the Ith text. The correlation coefficient is less than the second preset threshold. Finally, the rule extraction system extracts content from the Jth text according to the target knowledge graph corresponding to the Ith text by the generative large language model according to the positive feedback prompt information or the negative feedback prompt information.

[0085] Optionally, in order to adapt to the generative large language model, the rule extraction system can set positive feedback prompt information or negative feedback prompt information for the target knowledge graph corresponding to the first text, wherein the positive feedback prompt information is used to control the generative large language model to extract content related to the target knowledge graph corresponding to the first text from the Jth text, for example, if the user evaluates that the content of the target knowledge graph corresponding to the first text is more in line with the expected requirements, the positive feedback prompt information can be set for the target knowledge graph corresponding to the first text, so as to control the generative large language model to extract content more related to the target knowledge graph corresponding to the first text (i.e. the correlation coefficient is greater than the first preset threshold) in the subsequent text content extraction process.

[0086] On the other hand, if the user evaluates that the content of the target knowledge graph corresponding to the first text does not meet the expected requirements, the negative feedback prompt information can be set for the target knowledge graph corresponding to the first text, so as to control the generative large language model to try not to extract content more related to the target knowledge graph corresponding to the first text (i.e. the correlation coefficient is less than the second preset threshold) in the subsequent text content extraction process.

[0087] It should be noted that the first preset threshold and the second preset threshold can be set by the user, and in addition, since the generative large language model can convert data into vector form when processing data, the correlation coefficient can be determined by calculating the similarity (such as cosine similarity) or Pearson correlation coefficient between vectors. By setting the positive feedback prompt information or the negative feedback prompt information, the flexibility of the user controlling the content extraction direction of the large language model can be improved.

[0088] In an optional embodiment, after filling the content extracted from the Jth text into the target knowledge graph corresponding to the first text to obtain the target knowledge graph corresponding to the first text and the Jth text, the rule extraction system can obtain the graph similarity between the target knowledge graph corresponding to the first text and the target knowledge graph corresponding to the first text and the Jth text. The host security rules extracted based on the target knowledge graph corresponding to the first text can be taken as the first rules, and the host security rules extracted based on the target knowledge graph corresponding to the first text and the Jth text can be taken as the second rules. By obtaining the rule similarity between the first rules and the second rules, according to the graph similarity and / or the rule similarity, it is determined whether to extract content from other texts according to the target knowledge graph corresponding to the first text and the Jth text, wherein the other texts are texts other than the first text and the Jth text in the N texts.

[0089] Optionally, the rule extraction system can detect whether the graph similarity is greater than the preset similarity. If it is detected that the graph similarity is greater than the preset similarity, it means that the content extracted from the Jth text is actually highly similar to the content extracted from the Ith text. At this time, the target knowledge graph does not update more new content, and it is also difficult to derive new host security rules. Therefore, the extraction of content from other texts can be stopped.

[0090] In addition, if it is detected that the rule similarity is greater than the preset similarity, it also means that it is actually difficult to derive new host security rules based on the target knowledge graph at this time. Therefore, the extraction of content from other texts can be stopped.

[0091] It should be noted that if the rule extraction system detects that both the graph similarity and the rule similarity are less than the preset similarity, the large language model can be controlled to continue extracting content from other texts based on the target knowledge graph corresponding to the Ith text and the Jth text.

[0092] It should also be noted that in addition to the above determination of whether to extract content from other texts based on the target knowledge graph corresponding to the Ith text and the Jth text according to the graph similarity and / or the rule similarity, the maximum number of iterative extractions can be preset to control the number of snowball extractions of the N texts. Assuming that the maximum number of iterative extractions is M, the target knowledge graph can be updated by snowballing extraction from M texts at most, so as to prevent endless processing of a large number of texts and waste of computing resources.

[0093] In an optional embodiment, the technical solution provided by the embodiments of the present application can be applied to various threat detection and response devices based on event data collection, including but not limited to endpoint detection and response, extended detection and response, and situation awareness devices, to meet the need of effectively extracting attack technology and tactic knowledge with high credibility and correlation from a large number of attack instance reports, and generating rules for detection. At the same time, it is also suitable for the knowledge needs of security information and event management platforms for complex advanced threat attack detection and tracing processes.

[0094] The technical solution of the present application improves the knowledge extraction method and technology based on the large language model LLM, establishes the required knowledge range in combination with the general threat detection knowledge framework, and uses the initial information structure framework, thereby reducing the divergence of LLM in the information generation process and improving the accuracy and usability of knowledge extraction. Among them, the structured attack technology template can efficiently accumulate knowledge and generalize patterns, thereby generating detection rules that can be used in the threat detection process, and attack process correlation behavior rules that can be used in the threat tracing process.

[0095] By the technical solution of the present application, the following technical effects can be achieved at least:

[0096] 1. The powerful language analysis capability of the large language model is fully utilized to quickly process a large number of security attack reports, so as to extract more threat attack knowledge for users more quickly and enhance the response speed of security detection.

[0097] 2. The attack technology knowledge graph template in the present application has a specific graph structure, and the knowledge extracted by the LLM must conform to the structure set by the graph, so that the structured knowledge can be efficiently generalized and rule-converted by the algorithm, thereby improving the accuracy and coverage of knowledge extraction and enhancing the efficiency of knowledge to rule generation conversion.

[0098] 3. Most of the processes of the technical solution of the present application are automatic processes, and only part of the links need manual review and approval, thereby greatly reducing manual intervention and reducing the extraction cost of host security rules.

[0099] According to another aspect of the embodiment of the present application, there is also provided a host security rule determination device based on a generative large language model, wherein, Figure 4 is a schematic diagram of an optional host security rule determination device based on a generative large language model according to an embodiment of the present application, as Figure 4 shown, the host security rule determination device based on the generative large language model comprises an acquisition unit 401, a target knowledge graph determination unit 402, and a host security rule determination unit 403.

[0100] Optionally, the acquisition unit 401 is configured to acquire an initial knowledge graph template, wherein the initial knowledge graph template is used to describe a host attack behavior to be detected; the target knowledge graph determination unit 402 is configured to perform content filling on the initial knowledge graph template by using the generative large language model to obtain a target knowledge graph, wherein the target knowledge graph comprises at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template; and the host security rule determination unit 403 is configured to determine a host security rule based on the at least one host attack behavior information in the target knowledge graph.

[0101] Optionally, the initial knowledge graph template comprises at least one transformation structure and at least one prompt information and a restriction condition, wherein different transformation structures represent different implementation manners of the host attack behavior, and the at least one prompt information and the restriction condition are used to prohibit the generative large language model from generating information irrelevant to the host attack behavior described in the initial knowledge graph template.

[0102] Optionally, the target knowledge graph determination unit 402 comprises a creation subunit, a merging processing subunit, and a first processing subunit. The creation subunit is configured to create system prompt information and system limitation conditions of the generative large language model, wherein the system prompt information and the system limitation conditions are used to control the content generation manner of the generative large language model; the merging processing subunit is configured to merge and process the initial knowledge graph template and the system prompt information and the system limitation conditions to obtain model input prompt information; and the first processing subunit is configured to input the model input prompt information and the text recording the host security event into the generative large language model, extract content from the text according to the model input prompt information by the generative large language model, and fill the extracted content into the initial knowledge graph template to obtain the target knowledge graph.

[0103] Optionally, the first processing subunit comprises a first processing module and a second processing module. The first processing module is configured to input the model input prompt information and each of the N texts into the generative large language model when the number of the texts is N, and extract content from each of the texts according to the model input prompt information by the generative large language model; and the second processing module is configured to fill the extracted content from each of the texts into the initial knowledge graph template to obtain the target knowledge graph corresponding to each of the texts.

[0104] Optionally, the first processing subunit comprises a first processing subunit, a second processing subunit, a third processing subunit, and a fourth processing subunit. The first processing subunit is configured to input the model input prompt information and an Ith text of the N texts into the generative large language model when the number of the texts is N, and extract content from the Ith text according to the model input prompt information by the generative large language model, wherein I is a positive integer less than or equal to N; the second processing subunit is configured to fill the extracted content from the Ith text into the initial knowledge graph template to obtain the target knowledge graph corresponding to the Ith text; the third processing subunit is configured to input the target knowledge graph corresponding to the Ith text and a Jth text of the N texts into the generative large language model, and extract content from the Jth text according to the target knowledge graph corresponding to the Ith text by the generative large language model, wherein the Jth text is different from the Ith text; and the fourth processing subunit is configured to fill the extracted content from the Jth text into the target knowledge graph corresponding to the Ith text to obtain the target knowledge graph corresponding to the Ith text and the Jth text.

[0105] Optionally, the third processing sub-module comprises an obtaining sub-module and a content extraction module. The obtaining sub-module is configured to obtain positive feedback prompt information or negative feedback prompt information, wherein the positive feedback prompt information is used to control the generative large language model to extract content from the Jth text that has a target knowledge graph relevance coefficient corresponding to the Ith text greater than a first preset threshold, and the negative feedback prompt information is used to control the generative large language model to extract content from the Jth text that has a target knowledge graph relevance coefficient corresponding to the Ith text less than a second preset threshold. The content extraction module is configured to extract content from the Jth text according to the target knowledge graph corresponding to the Ith text based on the positive feedback prompt information or the negative feedback prompt information through the generative large language model.

[0106] Optionally, the host security rule determination device based on the generative large language model further comprises a first obtaining unit, a first processing unit, a second processing unit, a second obtaining unit, and a first determination unit. The first obtaining unit is configured to obtain a graph similarity between a target knowledge graph corresponding to the Ith text and a target knowledge graph corresponding to the Ith text and the Jth text. The first processing unit is configured to extract a host security rule based on the target knowledge graph corresponding to the Ith text as a first rule. The second processing unit is configured to extract a host security rule based on the target knowledge graph corresponding to the Ith text and the Jth text as a second rule. The second obtaining unit is configured to obtain a rule similarity between the first rule and the second rule. The first determination unit is configured to determine whether to extract content from other texts according to the target knowledge graph corresponding to the Ith text and the Jth text, based on the graph similarity and / or the rule similarity, wherein the other texts are texts other than the Ith text and the Jth text in the N texts.

[0107] Optionally, the host security rule determination unit 403 comprises a host security rule extraction sub-unit configured to perform clustering operation on the at least one host attack behavior information to obtain a clustering result, and perform generalization operation on the clustering result to obtain the host security rule.

[0108] According to another aspect of the present application, a computer readable storage medium is also provided, wherein the computer readable storage medium stores a computer program, and the computer program is configured to execute the host security rule determination method based on the generative large language model of any one of the above aspects when running.

[0109] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors; a storage device for storing one or more programs, which when executed by the one or more processors, cause the one or more processors to implement a program for running, wherein the program is configured to perform the host security rule determination method based on the generative large language model of any of the above when running.

[0110] Figure 5 According to an optional schematic diagram of an electronic device of an embodiment of the present application, as shown in Figure 5 the present application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the host security rule determination method based on the generative large language model of any of the above when executing the program.

[0111] The above-mentioned embodiments or examples of the present application are not exhaustive, but only a part of the embodiments or examples, and are not specific limitations on the protection scope of the present application. In the case of no contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent embodiment, and the steps can be combined arbitrarily, for example, the scheme after removing part of the steps in a certain embodiment or example can be implemented as an independent embodiment, and the order of the steps in a certain embodiment or example can be exchanged arbitrarily, in addition, the optional mode or optional example in a certain embodiment or example can be combined arbitrarily; furthermore, the embodiments or examples can be combined arbitrarily, for example, the steps of different embodiments or examples can be combined arbitrarily, a certain embodiment or example can be combined with the optional mode or optional example of other embodiments or examples.

[0112] The above-mentioned serial numbers of the embodiments of the present application are only for description, not representing the advantages or disadvantages of the embodiments.

[0113] In the above-mentioned embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0114] In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other means. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interface, unit or module, which can be electrical or other forms.

[0115] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0116] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0117] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that contributes to the technical solutions or all or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and various program code storage media.

[0118] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A method for determining host security rules based on a generative large language model, characterized in that, The method comprises the following steps: acquiring an initial knowledge graph template, wherein the initial knowledge graph template is used to describe a host attack behavior to be detected; filling content in the initial knowledge graph template by using a generative large language model to obtain a target knowledge graph, wherein the target knowledge graph at least includes at least one host attack behavior information generated by the generative large language model according to the initial knowledge graph template; determining a host security rule based on the at least one host attack behavior information in the target knowledge graph; filling content in the initial knowledge graph template by using a generative large language model to obtain a target knowledge graph, comprising: creating system prompt information and system limitation conditions of the generative large language model, wherein the system prompt information and the system limitation conditions are used to control the content generation mode of the generative large language model; merging the initial knowledge graph template with the system prompt information and the system limitation conditions to obtain model input prompt information; inputting the model input prompt information and a text used to record a host security event into the generative large language model, extracting content from the text by using the generative large language model according to the model input prompt information, and filling the extracted content into the initial knowledge graph template to obtain the target knowledge graph. 2.The method of claim 1, wherein, The initial knowledge graph template includes at least one transformation structure and at least one prompt information and limitation condition, wherein different transformation structures represent different implementation modes of a host attack behavior, and the at least one prompt information and limitation condition are used to prohibit the generative large language model from generating information irrelevant to the host attack behavior described in the initial knowledge graph template. 3.The method of claim 1, wherein, Inputting the model input prompt information and a text used to record a host security event into the generative large language model, extracting content from the text by using the generative large language model according to the model input prompt information, and filling the extracted content into the initial knowledge graph template to obtain the target knowledge graph, comprising: when the number of the texts is N, inputting the model input prompt information and each of the N texts into the generative large language model, and extracting content from each of the texts by using the generative large language model according to the model input prompt information; filling the extracted content from each of the texts into the initial knowledge graph template to obtain a target knowledge graph corresponding to each of the texts. 4.The method of claim 1, wherein, Inputting the model input prompt information and a text used to record a host security event into the generative large language model, extracting content from the text by using the generative large language model according to the model input prompt information, and filling the extracted content into the initial knowledge graph template to obtain the target knowledge graph, comprising: When the number of the texts is N, input the model input prompt information and an Ith text of the N texts into the generative large language model, and extract content from the Ith text according to the model input prompt information through the generative large language model, wherein I is a positive integer less than or equal to N; Fill the extracted content from the Ith text into the initial knowledge graph template to obtain a target knowledge graph corresponding to the Ith text; Input the target knowledge graph corresponding to the Ith text and a Jth text of the N texts into the generative large language model, and extract content from the Jth text according to the target knowledge graph corresponding to the Ith text through the generative large language model, wherein the Jth text is different from the Ith text; Fill the extracted content from the Jth text into the target knowledge graph corresponding to the Ith text to obtain a target knowledge graph corresponding to the Ith text and the Jth text.

5. The method of claim 4, wherein the method further comprises: The content extracted from the Jth text according to the target knowledge graph corresponding to the Ith text through the generative large language model includes: Obtain positive feedback prompt information or negative feedback prompt information, wherein the positive feedback prompt information is used to control the generative large language model to extract content from the Jth text, which has a correlation coefficient greater than a first preset threshold with the target knowledge graph corresponding to the Ith text, and the negative feedback prompt information is used to control the generative large language model to extract content from the Jth text, which has a correlation coefficient less than a second preset threshold with the target knowledge graph corresponding to the Ith text; According to the positive feedback prompt information or the negative feedback prompt information, extract content from the Jth text according to the target knowledge graph corresponding to the Ith text through the generative large language model. 6.The method of claim 4, wherein, After filling the extracted content from the Jth text into the target knowledge graph corresponding to the Ith text to obtain a target knowledge graph corresponding to the Ith text and the Jth text, the host security rule determination method based on the generative large language model further includes: Obtain a graph similarity between the target knowledge graph corresponding to the Ith text and the target knowledge graph corresponding to the Ith text and the Jth text; Extract host security rules based on the target knowledge graph corresponding to the Ith text as first rules; Extract host security rules based on the target knowledge graph corresponding to the Ith text and the Jth text as second rules; Obtain a rule similarity between the first rules and the second rules; According to the graph similarity and / or the rule similarity, determine whether to extract content from other texts according to the target knowledge graph corresponding to the Ith text and the Jth text, wherein the other texts are texts other than the Ith text and the Jth text in the N texts. 7.The method of claim 1, wherein, Determine host security rules based on at least one host attack behavior information in the target knowledge graph, including: The at least one host attack behavior information is clustered to obtain a clustering result; The clustering result is generalized to obtain the host security rule. 8.A host security rule determination apparatus based on a generative large language model, characterized in that, Comprise: An acquisition unit is configured to acquire an initial knowledge graph template, wherein the initial knowledge graph template is used to describe a host attack behavior to be detected; A target knowledge graph determination unit is configured to fill content in the initial knowledge graph template by using a generative large language model to obtain a target knowledge graph, wherein the target knowledge graph at least includes at least one host attack behavior information generated by the generative large language model based on the initial knowledge graph template; A host security rule determination unit is configured to determine a host security rule based on the at least one host attack behavior information in the target knowledge graph; The target knowledge graph determination unit comprises a creation subunit, a merging processing subunit and a first processing subunit; the creation subunit is configured to create system prompt information and system limitation conditions of the generative large language model, wherein the system prompt information and the system limitation conditions are used to control a content generation manner of the generative large language model; the merging processing subunit is configured to merge and process the initial knowledge graph template, the system prompt information and the system limitation conditions to obtain model input prompt information; and the first processing subunit is configured to input the model input prompt information and a text used to record a host security event into the generative large language model, extract content from the text by using the generative large language model based on the model input prompt information, and fill the extracted content into the initial knowledge graph template to obtain the target knowledge graph.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is configured to execute the host security rule determination method based on the generative large language model in any one of claims 1 to 7 when running.

Images