Network security risk assessment method and related equipment based on large model

Abstract

The present application provides a network security risk assessment method and related equipment based on a large model. The method includes: using a trained detection model to obtain real-time data, and monitoring and analyzing the real-time data to identify network security risks; quantitatively assessing the network security risks and generating a risk assessment report using a Bayesian network; based on the network security risks, using meta-learning to update the detection model; storing the risk assessment report in a database, and visually displaying the risk assessment report. The embodiment of the present application uses a multimodal deep learning large model and meta-learning technology to monitor and analyze massive complex data in real time, improve the accuracy and timeliness of network security threat detection, and has adaptive learning and optimization capabilities.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security risk assessment method based on a large model and related equipment. Background Art

[0002] With the rapid development of the Internet and information technology, network security issues have become increasingly prominent. The network security threats faced by enterprises and organizations are becoming increasingly complex and diverse, the means of network attacks are constantly escalating, and the frequency and scale of attacks are also increasing. In this context, how to effectively detect, prevent and respond to network security threats has become an important topic in the field of network security.

[0003] Traditional network security threat detection methods mainly rely on rules and feature matching. These methods are effective in dealing with known threats, but often show low detection accuracy and response speed when facing new and complex network threats. For example, signature-based intrusion detection systems (IDS) and antivirus software rely on feature signature libraries of known threats, which makes them relatively efficient in detecting known threats, but traditional methods are unable to cope with unknown threats and zero-day vulnerabilities.

[0004] In addition, as the scale of networks and the amount of data continue to grow, traditional methods are unable to efficiently process and analyze large amounts of complex network data. The diversity of network environments and the complexity of data often lead to performance bottlenecks in traditional methods when processing real-time data, making it difficult to detect and respond to security threats in a timely manner. Especially in large-scale enterprise network environments, massive amounts of data traffic and log files need to be quickly analyzed and processed, which poses a huge challenge to traditional methods.

[0005] In addition, traditional network security solutions are usually static and require regular updates and maintenance to deal with new threat forms and attack methods. However, network threat forms and methods are constantly evolving, and traditional security measures need to be frequently updated, making it difficult to maintain continuous protection effects. When responding to the dynamically changing threat environment, enterprises and organizations often need to invest a lot of time and resources to adjust and optimize security strategies, which makes the overall network security protection costly and inefficient.

[0006] In the existing technology, although some network security threat detection methods based on machine learning and artificial intelligence have improved the intelligence and automation level of threat detection to a certain extent, these methods still have some limitations. For example, traditional machine learning models usually rely on manual feature engineering and static model training, which are difficult to adapt to the rapidly changing network environment and evolving threat forms. At the same time, traditional machine learning models often have difficulties in feature fusion and dimensionality reduction when processing multimodal data, resulting in unsatisfactory performance and effects of the models in practical applications. Summary of the invention

[0007] In view of this, the purpose of this application is to propose a network security risk assessment method and related equipment based on a large model.

[0008] Based on the above objectives, this application provides a network security risk assessment method based on a large model, including:

[0009] Using the trained detection model to obtain real-time data, and monitoring and analyzing the real-time data to identify network security risks;

[0010] Conducting a quantitative assessment of the network security risks and generating a risk assessment report using a Bayesian network;

[0011] Based on the network security risk, updating the detection model using meta-learning;

[0012] The risk assessment report is stored in a database, and the risk assessment report is visually displayed.

[0013] In a possible implementation, the detection model is trained by the following method:

[0014] Preprocess the acquired raw data to obtain a structured data set;

[0015] The multimodal deep learning model is trained using the structured data set to obtain the detection model.

[0016] In a possible implementation, preprocessing the acquired raw data to obtain a structured data set includes:

[0017] Collecting the raw data from network traffic, log files, system events, and user behavior data sources;

[0018] The collected raw data is cleaned, normalized, denoised, and feature extracted to generate the structured data set.

[0019] In a possible implementation, the using the structured data set to train a multimodal deep learning model to obtain the detection model includes:

[0020] Using a self-attention mechanism to process the text and sequence data in the structured data set to obtain a first feature;

[0021] Using a graph convolutional network to process the network structure data in the structured data set to obtain a second feature;

[0022] The second feature is optimized using a graph attention network to obtain a third feature;

[0023] Using a multilayer perceptron and an autoencoder to perform feature fusion and dimensionality reduction processing on the structured data, the first feature, the second feature, and the third feature to obtain a fourth feature;

[0024] The multimodal deep learning model is trained based on the fourth feature to obtain the detection model.

[0025] In a possible implementation, the method of acquiring real-time data using a trained detection model, and monitoring and analyzing the real-time data to identify network security risks includes:

[0026] generating a real-time data matrix according to the real-time data;

[0027] Processing the real-time data matrix using the detection model to calculate a potential threat score matrix;

[0028] The potential threat scoring matrix is ​​classified to identify different types of network security risks.

[0029] In a possible implementation, the updating of the detection model by using meta-learning based on the network security risk includes:

[0030] Obtain new real-time data based on the cybersecurity risks described;

[0031] generating a new structured data set based on the new real-time data;

[0032] Based on the new structured dataset, meta-learning is used to update the weights and bias vectors of the detection model.

[0033] Based on the same inventive concept, the embodiment of the present application also provides a network security risk assessment device based on a large model, including:

[0034] An identification module is configured to obtain real-time data using a trained detection model, and monitor and analyze the real-time data to identify network security risks;

[0035] An assessment module, configured to perform a quantitative assessment on the network security risk and generate a risk assessment report using a Bayesian network;

[0036] An updating module, configured to update the detection model using meta-learning based on the network security risk;

[0037] The storage and display module is configured to store the risk assessment report in a database and to visually display the risk assessment report.

[0038] Based on the same inventive concept, an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a large model-based network security risk assessment method as described in any one of the above is implemented.

[0039] Based on the same inventive concept, an embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute any of the above-mentioned large model-based network security risk assessment methods.

[0040] Based on the same inventive concept, an embodiment of the present application also provides a computer program product, which includes computer program instructions, and the computer instructions are used to enable the computer program product to execute any of the above-mentioned large model-based network security risk assessment methods.

[0041] From the above, it can be seen that the network security risk assessment method and related equipment based on a large model provided by the present application use a trained detection model to obtain real-time data, and monitor and analyze the real-time data to identify network security risks; quantitatively evaluate the network security risks and generate a risk assessment report using a Bayesian network; based on the network security risks, use meta-learning to update the detection model; store the risk assessment report in a database, and visualize the risk assessment report. The embodiment of the present application adopts a multimodal deep learning large model and meta-learning technology to monitor and analyze massive and complex data in real time, improve the accuracy and timeliness of network security threat detection, and has adaptive learning and optimization capabilities, and can continuously update and optimize the detection model according to new threats and assessment results, providing a scalable and adaptive network security solution that adapts to network environments of different sizes and complexities, thereby better protecting the network security of enterprises and organizations. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 A schematic diagram of a process flow of a network security risk assessment method based on a large model according to an embodiment of the present application;

[0044] Figure 2 This is a schematic diagram of the structure of a network security risk assessment device based on a large model according to an embodiment of the present application;

[0045] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0047] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0048] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0049] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0050] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0051] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0052] As mentioned in the background technology section, with the rapid development of the Internet and information technology, network security issues have become increasingly prominent. The network security threats faced by enterprises and organizations are becoming increasingly complex and diverse, the means of network attacks are constantly escalating, and the frequency and scale of attacks are also increasing. In this context, how to effectively detect, prevent and respond to network security threats has become an important topic in the field of network security.

[0053] Traditional network security threat detection methods mainly rely on rules and feature matching. These methods are effective in dealing with known threats, but often show low detection accuracy and response speed when facing new and complex network threats. For example, signature-based intrusion detection systems (IDS) and antivirus software rely on feature signature libraries of known threats, which makes them relatively efficient in detecting known threats, but traditional methods are unable to cope with unknown threats and zero-day vulnerabilities.

[0054] In addition, as the scale of networks and the amount of data continue to grow, traditional methods are unable to efficiently process and analyze large amounts of complex network data. The diversity of network environments and the complexity of data often lead to performance bottlenecks in traditional methods when processing real-time data, making it difficult to detect and respond to security threats in a timely manner. Especially in large-scale enterprise network environments, massive amounts of data traffic and log files need to be quickly analyzed and processed, which poses a huge challenge to traditional methods.

[0055] In addition, traditional network security solutions are usually static and require regular updates and maintenance to deal with new threat forms and attack methods. However, network threat forms and methods are constantly evolving, and traditional security measures need to be frequently updated, making it difficult to maintain continuous protection effects. When responding to the dynamically changing threat environment, enterprises and organizations often need to invest a lot of time and resources to adjust and optimize security strategies, which makes the overall network security protection costly and inefficient.

[0056] In the existing technology, although some network security threat detection methods based on machine learning and artificial intelligence have improved the intelligence and automation level of threat detection to a certain extent, these methods still have some limitations. For example, traditional machine learning models usually rely on manual feature engineering and static model training, which are difficult to adapt to the rapidly changing network environment and evolving threat forms. At the same time, traditional machine learning models often have difficulties in feature fusion and dimensionality reduction when processing multimodal data, resulting in unsatisfactory performance and effects of the models in practical applications.

[0057] Based on the above considerations, the embodiment of the present application proposes a network security risk assessment method and related equipment based on a large model, which uses a trained detection model to obtain real-time data, monitors and analyzes the real-time data, and identifies network security risks; quantitatively evaluates the network security risks and generates a risk assessment report using a Bayesian network; based on the network security risks, uses meta-learning to update the detection model; stores the risk assessment report in a database, and visualizes the risk assessment report. The embodiment of the present application adopts a multimodal deep learning large model and meta-learning technology, which can monitor and analyze massive and complex data in real time, improve the accuracy and timeliness of network security threat detection, and has adaptive learning and optimization capabilities. It can continuously update and optimize the detection model according to new threats and assessment results, and provide a scalable and adaptive network security solution that can adapt to network environments of different sizes and complexities, thereby better protecting the network security of enterprises and organizations.

[0058] The technical solutions of the embodiments of the present application are described in detail below through specific examples.

[0059] refer to Figure 1 The network security risk assessment method based on a large model in the embodiment of the present application includes the following steps:

[0060] Step S101, using the trained detection model to obtain real-time data, and monitoring and analyzing the real-time data to identify network security risks;

[0061] Step S102, quantitatively assessing the network security risk and generating a risk assessment report using a Bayesian network;

[0062] Step S103, based on the network security risk, updating the detection model by using meta-learning;

[0063] Step S104: storing the risk assessment report in a database and visually displaying the risk assessment report.

[0064] Regarding step S101, before performing step S101, the detection model needs to be trained.

[0065] In some embodiments, the detection model is trained by the following method: preprocessing the acquired raw data to obtain a structured data set; using the structured data set to train a multimodal deep learning model to obtain the detection model.

[0066] In some embodiments, the acquired raw data is preprocessed to obtain a structured data set, including: collecting the raw data from network traffic, log files, system events, and user behavior data sources; cleaning, normalizing and denoising the collected raw data, and performing feature extraction to generate the structured data set.

[0067] In some embodiments, the use of the structured data set to train the multimodal deep learning model to obtain the detection model includes: using a self-attention mechanism to process the text and sequence data in the structured data set to obtain a first feature; using a graph convolutional network to process the network structure data in the structured data set to obtain a second feature; using a graph attention network to optimize the second feature to obtain a third feature; using a multilayer perceptron and an autoencoder to perform feature fusion and dimensionality reduction on the structured data, the first feature, the second feature and the third feature to obtain a fourth feature; training the multimodal deep learning model based on the fourth feature to obtain the detection model.

[0068] In this embodiment, training the detection model includes the following steps:

[0069] Collect raw data from network traffic, including packets, TCP connections, and UDP traffic:

[0070] ;

[0071] in, represents the i-th network traffic data, Indicates the total amount of network data traffic;

[0072] Collect raw data from system log files, including event logs, security logs, and application logs:

[0073] ;

[0074] in, Represents the i-th system log file data, Indicates the amount of system log file data;

[0075] Collects raw data from system events, including system errors, system warnings, and system information:

[0076] ;

[0077] in, Represents the i-th system event data, Indicates the number of system event data;

[0078] Collect raw data from user behavior data sources, including user login records, operation records, and access logs:

[0079] ;

[0080] in, represents the behavior data of the i-th user, Indicates the amount of user behavior data;

[0081] The final raw data set is represented as:

[0082] .

[0083] Furthermore, the collected raw data is cleaned to remove noise data and invalid data;

[0084] Normalize the cleaned data to unify the data from different sources into the same dimensional range;

[0085] The normalized data is subjected to denoising, and the high-frequency noise components in the data are removed by wavelet transform method;

[0086] Perform feature extraction on the denoised data and use the TF-IDF algorithm to calculate the weight of each feature;

[0087] TF-IDF (term frequency–inverse document frequency) is a common weighting technique used in information retrieval and data mining. TF is term frequency and IDF is inverse document frequency. TF-IDF is a statistical method used to assess the importance of a word to a document set or a document in a corpus. The importance of a word increases in direct proportion to the number of times it appears in a document, but decreases in inverse proportion to the frequency of its appearance in the corpus. Various forms of TF-IDF weighting are often used by search engines as a measure or rating of the relevance between a document and a user query.

[0088] The extracted features are combined into a structured data set, expressed as:

[0089] ;

[0090] in, A feature set representing network traffic data, A feature set representing system log file data, A collection of features representing system event data, A collection of features representing user behavior data.

[0091] Furthermore, the preprocessed structured dataset Input into a large multimodal deep learning model for training;

[0092] The self-attention mechanism based on the Transformer architecture processes text and sequence data:

[0093] Text data Segment the words and embed them into a high-dimensional vector space to obtain the embedding matrix E;

[0094] Input the embedding matrix E to the Transformer model and calculate the self-attention weight :

[0095] ;

[0096] in, represents the correlation score between the i-th position and the j-th position in the input sequence, which is calculated by a feedforward neural network;

[0097] Use the self-attention weights to perform weighted averaging on the embedding matrix to obtain the weighted feature representation (First feature);

[0098] Introducing a domain-adaptive mechanism to jointly train the source domain, normal network traffic, and the target domain, abnormal network traffic to ensure that the model can adapt to different network environments and threat scenarios;

[0099] Use graph convolutional networks to process network structure data:

[0100] Build a network structure diagram ,in is a node set, is the edge set;

[0101] Input the node feature matrix X into the graph convolutional network processing network model to calculate the node feature representation :

[0102] ;

[0103] in, represents the node feature representation of the lth layer (the second feature), represents the set of neighbor nodes of node i, represents the weight matrix of the lth layer, represents the activation function, Represents a certain relationship weight between node i and its neighbor node k;

[0104] Introducing a graph embedding method based on anomaly detection to dynamically adjust the network structure so that the model can identify network attacks and abnormal behaviors;

[0105] Use graph attention network to optimize node feature representation:

[0106] Input graph convolutional network to process node feature representation generated by the network To the graph attention network model, calculate the attention weights between nodes :

[0107] ;

[0108] in, and Represent the feature vectors of node i and node j respectively, represents the weight matrix, represents the weight vector of the attention mechanism, Represents the Leaky ReLU activation function;

[0109] Use attention weights to perform weighted averaging of node features to obtain optimized node feature representation (Third feature);

[0110] Combined with the graph attention mechanism based on domain adaptation, the attention weight is adjusted dynamically, so that the model can be adaptively adjusted in different network environments, improving the detection ability of unknown threats;

[0111] Using multi-layer perceptron and autoencoder for feature fusion and dimensionality reduction:

[0112] Representing features of different modes Perform feature connection to obtain the fusion feature matrix :

[0113] ;

[0114] in, Represents a feature connection operation;

[0115] The fusion feature matrix Input into the multi-layer perceptron model for nonlinear transformation to obtain high-dimensional feature representation ;

[0116] Using autoencoders to represent high-dimensional features Perform dimensionality reduction to obtain low-dimensional feature representation (Fourth characteristic);

[0117] The above steps introduce a feature representation method based on latent semantic analysis in the dimensionality reduction process, perform semantic optimization and fusion on the features, use a large multimodal deep learning model to complete the training of the structured data set, and generate a network security threat detection model.

[0118] After generating the detection model, it is necessary to deploy the trained network security threat detection model to continuously monitor real-time network traffic, system logs, and user behavior data, and use Apache Kafka technology for data transmission and processing.

[0119] Apache Kafka is an open source messaging system project written in Scala. The goal of the project is to provide a unified, high-throughput, low-latency platform for processing real-time data.

[0120] When deploying a network security threat detection model, define the model's parameter matrix W and bias vector b, and initialize the model weights:

[0121] ;

[0122] in, represents the weight matrix after initialization, is a random normal distribution matrix, which is used to prevent overfitting in the initial state of the model.

[0123] In the Kafka producer module, real-time network traffic data is sharded and grouped according to timestamp T and packet size P:

[0124] ;

[0125] in, represents the Dirac delta function, represents the i-th network traffic data packet, represents the kth group of real-time network traffic data, represents the timestamp of the ith data packet, Indicates The timestamp of the data packet, Indicates the size of the i-th data packet;

[0126] In the Kafka consumer module, the transmitted real-time network traffic data is decoded and reassembled and converted into a feature matrix :

[0127] ;

[0128] in, Represents the data transformation matrix, which is used to transform the original data into a format suitable for model input;

[0129] Transmit system log data and user behavior data to the Kafka cluster through the Kafka producer module and define the transmission function :

[0130] ;

[0131] in, represents the time domain, is the attenuation coefficient, which is used to ensure the stability during data transmission. express time;

[0132] Kafka is a distributed, partitioned, multi-replica log delivery service that provides the functionality of a messaging system through a unique design.

[0133] In the Kafka consumer module, system log data and user behavior data are obtained from the Kafka cluster and converted into a system log data feature matrix and user behavior data feature matrix :

[0134] ;

[0135] ;

[0136] in, and Represent the transformation matrices of system log data and user behavior data respectively;

[0137] The network security threat detection model analyzes the received data and defines the analysis function , used to identify potential threats:

[0138] ;

[0139] in, represents the activation function, Represents a feature join operation.

[0140] With respect to step S101, the trained detection model is used to acquire real-time data, and the real-time data is monitored and analyzed to identify network security risks.

[0141] With respect to step S102, the network security risk is quantitatively assessed, and a risk assessment report is generated using a Bayesian network.

[0142] In some embodiments, the method of acquiring real-time data using a trained detection model, monitoring and analyzing the real-time data, and identifying network security risks includes: generating a real-time data matrix based on the real-time data; processing the real-time data matrix using the detection model to calculate a potential threat scoring matrix; and classifying the potential threat scoring matrix to identify different types of network security risks.

[0143] In this embodiment, the real-time monitoring data is input into the network security threat detection model, and the input data matrix is ​​defined as :

[0144] ;

[0145] in, , and The feature matrices representing real-time network traffic data, system log data, and user behavior data respectively;

[0146] Using the network security threat detection model to detect the input data matrix Processing is performed to calculate the potential threat score matrix S;

[0147] Classify the potential threat score matrix S, identify different types of network security threats and vulnerabilities, and define the classification function :

[0148] ;

[0149] in, represents the score belonging to category c in the score matrix S, and C represents the set of threat categories;

[0150] Identified network security threats and vulnerabilities are marked and threat detection reports are generated.

[0151] Furthermore, with respect to step S103, based on the network security risk, the detection model is updated using meta-learning.

[0152] In some embodiments, the detection model is updated using meta-learning based on the network security risk, including: acquiring new real-time data according to the network security risk; generating a new structured data set based on the new real-time data; and updating the weights and bias vectors of the detection model based on the new structured data set using meta-learning.

[0153] In this embodiment, new training data is collected based on newly detected network security threats and assessment results. ,The training data includes newly added network traffic data, system log data and user ,behavior data;

[0154] For new training data Perform preprocessing, including cleaning, normalization, and feature extraction, to generate a new structured dataset ;

[0155] Use meta-learning technology to optimize the network security threat detection model and define the meta-learning update function :

[0156] ;

[0157] in, represents the meta-learning update function;

[0158] Update function through meta-learning Update the model weight W and bias vector b;

[0159] The optimized model is redeployed into the network security threat detection system to continuously monitor and analyze network traffic, system logs, and user behavior data.

[0160] Furthermore, with respect to step S104, the risk assessment report is stored in a database, and the risk assessment report is visually displayed.

[0161] In this embodiment, the risk assessment report and related data are stored in the Hadoop HDFS database, and a visual display and management tool are provided through a user interface to support administrators to view, analyze and manage network security risk assessment results.

[0162] Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has a lot in common with existing distributed file systems. But at the same time, it is also very different from other distributed file systems. HDFS is a highly fault-tolerant system suitable for deployment on cheap machines. HDFS can provide high-throughput data access and is very suitable for applications on large-scale data sets. HDFS relaxes some POSIX constraints to achieve the purpose of streaming file system data. HDFS was originally developed as the infrastructure of the Apache Nutch search engine project. HDFS is part of the Apache Hadoop Core project.

[0163] HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. It provides high throughput to access application data and is suitable for applications with large data sets. HDFS relaxes POSIX requirements so that streaming access can be implemented for data in the file system.

[0164] It can be seen from the above embodiments that the network security risk assessment method based on a large model described in the embodiments of the present application, the network security risk assessment method based on a large model and related equipment, use a trained detection model to obtain real-time data, and monitor and analyze the real-time data to identify network security risks; quantitatively evaluate the network security risks, and generate a risk assessment report using a Bayesian network; based on the network security risks, use meta-learning to update the detection model; store the risk assessment report in a database, and visualize the risk assessment report. The embodiments of the present application, by adopting a multimodal deep learning large model and meta-learning technology, can monitor and analyze massive and complex data in real time, improve the accuracy and timeliness of network security threat detection, and have adaptive learning and optimization capabilities, and can continuously update and optimize the detection model according to new threats and evaluation results, providing a scalable and adaptive network security solution that adapts to network environments of different scales and complexities, thereby better protecting the network security of enterprises and organizations.

[0165] In another feasible embodiment, a large Internet enterprise often faces various network security threats in daily operation and maintenance. The enterprise's network environment is complex, containing a large amount of network traffic, system logs, and user behavior data. In order to ensure network security, the enterprise needs an efficient, accurate, and real-time monitoring network security risk assessment system to promptly discover and respond to potential network security threats and vulnerabilities.

[0166] In this embodiment, the enterprise deploys a network security risk assessment system based on a large model, which is mainly applied through the following steps:

[0167] First, the data collection module collects raw data from the enterprise's network traffic, system logs, and user behavior data sources. These data include network packets, TCP connections, UDP traffic, event logs, security logs, application logs, system errors, system warnings, system information, user login records, operation records, and access logs.

[0168] Then, the data preprocessing module cleans, normalizes and denoises the collected raw data, and uses the TF-IDF algorithm to extract features to generate a structured data set. The data cleaning process removes noise data and invalid data, the normalization process unifies data from different sources into the same dimensional range, the denoising process uses the wavelet transform method to remove high-frequency noise components in the data, and the feature extraction process calculates the weight of each feature.

[0169] Next, the model training module uses the preprocessed structured data set and a multimodal deep learning large model for training. The self-attention mechanism of the Transformer architecture is used to process text and sequence data, the graph convolution network and graph attention network are used to process network structure data, and multi-layer perceptrons and autoencoders are used for feature fusion and dimensionality reduction to generate a network security threat detection model.

[0170] After deploying the trained model to the real-time monitoring module, Apache Kafka technology is used for data transmission and processing to continuously monitor real-time network traffic, system logs, and user behavior data. The Kafka producer module shards the real-time network traffic data and transmits it to the Kafka cluster. The Kafka consumer module decodes and reorganizes the transmitted data, converts it into a feature matrix, and inputs it into the network security threat detection model for analysis.

[0171] Through the threat identification module, the network security threat detection model analyzes the real-time monitoring data, identifies potential network security threats and vulnerabilities, and generates threat detection reports. The detection results are stored in the database, and the administrator can view, analyze and manage these assessment results through the user interface.

[0172] In a cybersecurity incident drill, the enterprise used the system of the present invention to conduct a comprehensive cybersecurity risk assessment. The drill was conducted from June 1, 2024 to June 30, 2024 at the data center of the enterprise headquarters. During the drill, the enterprise tested the threat detection and response capabilities of the system by simulating various network attack methods. In this drill, the comparison data between the method of the present invention and the traditional method are shown in Table 1 below:

[0173] Table 1 Comparative data of the method of the present invention and the traditional method

[0174]

[0175] It can be seen from the above data that the method of the present invention is superior to traditional methods in terms of detection accuracy, response time, false alarm rate, amount of data processed and new threat detection rate, and significantly improves the performance and efficiency of network security threat detection. During the drill, the enterprise successfully detected and responded to multiple simulated attacks in a timely manner using the method of the present invention, and generated a detailed risk assessment report, which included specific risk scores, possible impacts and response suggestions. These data prove that the method of the present invention can provide efficient, accurate and real-time network security risk assessment in a complex network environment, providing reliable protection for enterprise network security.

[0176] This application proposes a network security risk assessment method based on a large model, aiming to solve the problems existing in the prior art, such as low detection accuracy, slow response speed, difficulty in processing large amounts of complex data, and lack of dynamic adaptive capabilities. By adopting a multimodal deep learning large model and meta-learning technology, it is possible to monitor and analyze massive amounts of complex data in real time, improve the accuracy and timeliness of network security threat detection, and have adaptive learning and optimization capabilities, and can continuously update and optimize the detection model according to new threats and assessment results, providing a scalable and adaptive network security solution that adapts to network environments of different sizes and complexities, thereby better protecting the network security of enterprises and organizations.

[0177] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0178] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0179] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a network security risk assessment device based on a large model.

[0180] refer to Figure 2 , the network security risk assessment device based on the large model comprises:

[0181] The identification module 21 is configured to obtain real-time data using the trained detection model, and monitor and analyze the real-time data to identify network security risks;

[0182] An assessment module 22, configured to perform a quantitative assessment on the network security risk and generate a risk assessment report using a Bayesian network;

[0183] An updating module 23, configured to update the detection model using meta-learning based on the network security risk;

[0184] The storage and display module 24 is configured to store the risk assessment report in a database and visually display the risk assessment report.

[0185] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0186] The device of the above embodiment is used to implement the corresponding large model-based network security risk assessment method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0187] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the large model-based network security risk assessment method described in any of the above embodiments is implemented.

[0188] Figure 3 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0189] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0190] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0191] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0192] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0193] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0194] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0195] The electronic device of the above-mentioned embodiment is used to implement the corresponding large model-based network security risk assessment method in any of the above-mentioned embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0196] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the large model-based network security risk assessment method as described in any of the above embodiments.

[0197] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0198] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the network security risk assessment method based on a large model as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0199] Based on the same inventive concept, corresponding to the network security risk assessment method based on a large model described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the network security risk assessment method based on a large model. Corresponding to the execution subject corresponding to each step in each embodiment of the network security risk assessment method based on a large model, the processor that executes the corresponding step can belong to the corresponding execution subject.

[0200] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the large model-based network security risk assessment method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0201] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0202] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device may be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present application are to be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0203] Although the present application has been described in conjunction with specific embodiments of the present application, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0204] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A network security risk assessment method based on a large model, characterized in that: include: Using the trained detection model to obtain real-time data, and monitoring and analyzing the real-time data to identify network security risks; Conducting a quantitative assessment of the network security risks and generating a risk assessment report using a Bayesian network; Based on the network security risk, updating the detection model using meta-learning; The risk assessment report is stored in a database and the risk assessment report is visually displayed; The detection model is trained by the following method: Preprocess the acquired raw data to obtain a structured data set; Using the structured data set to train a multimodal deep learning model to obtain the detection model; The obtained raw data is preprocessed to obtain a structured data set, including: Collecting the raw data from network traffic, log files, system events, and user behavior data sources; Cleaning, normalizing and denoising the collected raw data, and performing feature extraction to generate the structured data set; The method of training the multimodal deep learning model using the structured data set to obtain the detection model includes: Using a self-attention mechanism to process the text and sequence data in the structured data set to obtain a first feature; Using a graph convolutional network to process the network structure data in the structured data set to obtain a second feature; The second feature is optimized using a graph attention network to obtain a third feature; Using a multilayer perceptron and an autoencoder to perform feature fusion and dimensionality reduction processing on the structured data, the first feature, the second feature, and the third feature to obtain a fourth feature; Training the multimodal deep learning model based on the fourth feature to obtain the detection model; The method of using the trained detection model to obtain real-time data, and monitoring and analyzing the real-time data to identify network security risks includes: generating a real-time data matrix according to the real-time data; Processing the real-time data matrix using the detection model to calculate a potential threat score matrix; Classifying the potential threat scoring matrix to identify different types of network security risks; The updating of the detection model by using meta-learning based on the network security risk includes: Obtain new real-time data based on the cybersecurity risks described; generating a new structured data set based on the new real-time data; Based on the new structured dataset, meta-learning is used to update the weights and bias vectors of the detection model.

2. A network security risk assessment device based on a large model, applied to the network security risk assessment method based on a large model as claimed in claim 1, characterized in that: include: An identification module is configured to obtain real-time data using a trained detection model, and monitor and analyze the real-time data to identify network security risks; An assessment module, configured to perform a quantitative assessment on the network security risk and generate a risk assessment report using a Bayesian network; An updating module, configured to update the detection model using meta-learning based on the network security risk; The storage and display module is configured to store the risk assessment report in a database and to visually display the risk assessment report.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to claim 1 is implemented.

4. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method of claim 1.

5. A computer program product comprising computer program instructions, which, when executed on a computer, cause the computer to execute the method according to claim 1.

Images