Intrusion detection and diagnosis method integrating interpretable model and large language model

Abstract

The present invention belongs to the technical field of network security, and discloses an intrusion detection and diagnosis method integrating an interpretable model and a large language model, including: training a decision tree model and extracting decision rules; inputting each sample in a network traffic sample set into a decision tree model to construct a multi-hot encoding vector, and using the multi-hot encoding vector to update the network traffic sample set; based on the updated network traffic sample set, using a logistic regression algorithm to train a binary classification model; obtaining a network traffic data file to be detected, inputting a decision tree model and a binary classification model, obtaining a corresponding binary classification result and a weight of each component in the multi-hot encoding vector to be detected; taking the corresponding decision rule as a detection result explanation according to the weight; converting the detection result explanation into a prompt word, and inputting the large language model to obtain a diagnosis result. The present invention has good interpretability, and can obtain a more readable and more human-cognizable diagnosis result.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an intrusion detection and diagnosis method integrating an interpretable model with a large language model. Background Art

[0002] Intrusion detection systems (IDS) play a vital role in the field of network security, mainly monitoring network or system activities to detect malicious behavior or violations. As network attacks become more complex and frequent, intrusion detection technology is also constantly improving. These systems are becoming more intelligent and automated, and can more effectively combat increasingly complex network threats. At the same time, with the popularization of cloud computing and Internet of Things (IoT) technologies, intrusion detection technology is also constantly expanding into these new areas.

[0003] Deep learning-based intrusion detection technology has made significant progress, mainly due to its advantages in processing large-scale data, automatic feature extraction and pattern recognition. Researchers have developed a variety of deep learning-based models, such as multi-layer perceptron (MLP), convolutional neural network (CNN) and long short-term memory network (LSTM), to improve the classification and identification capabilities of network traffic and malware. These models can learn complex features to distinguish normal traffic from malicious traffic from raw traffic data, or detect malware by converting the binary data of malware files into images and using CNN's powerful image recognition capabilities.

[0004] Although deep learning-based intrusion detection systems have made significant progress in detection capabilities, they still have some shortcomings, especially in terms of explainability. Many of these systems are "black box" models, which, while highly effective in detecting intrusions, often fail to provide human-friendly explanations. This means that when the system issues an alarm, security analysts may have difficulty understanding why the alarm was triggered, adversely affecting the investigation and response to potential security incidents. In addition, this lack of explainability can also lead to trust issues, response challenges, increased difficulty in tuning and improvement, and risks in compliance and auditing. Summary of the invention

[0005] The purpose of the present invention is to provide an intrusion detection and diagnosis method that integrates an interpretable model and a large language model, which has good interpretability and can obtain a diagnosis result that is more readable and more in line with human cognition.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] An intrusion detection and diagnosis method integrating an interpretable model and a large language model, the intrusion detection and diagnosis method integrating an interpretable model and a large language model comprising:

[0008] Construct a network traffic sample set, use it to train a decision tree model, and extract the branch path of the trained decision tree model as the decision rule;

[0009] Input each sample in the network traffic sample set into the trained decision tree model, construct a multi-hot encoding vector according to the leaf node of the decision tree in the decision tree model where the sample arrives, and use the multi-hot encoding vector to update the network traffic sample set;

[0010] Based on the updated network traffic sample set, a binary classification model is trained using a logistic regression algorithm, wherein the output of the binary classification model includes a binary classification result and a weight of each component in a multi-hot encoding vector;

[0011] Acquire a network traffic data file to be detected, and extract a network traffic feature vector of the network traffic data file to be detected, to obtain a network traffic feature vector to be detected;

[0012] Inputting the network traffic feature vector to be detected into the trained decision tree model to obtain the multi-hot encoding vector to be detected, and inputting the multi-hot encoding vector to be detected into the binary classification model to obtain the binary classification result corresponding to the network traffic data file to be detected and the weight of each component in the multi-hot encoding vector to be detected;

[0013] Take the top weight of the multi-hot encoding vector to be tested non-zero components, determine the front The leaf nodes corresponding to the non-zero components are The decision rules corresponding to the branch paths of leaf nodes in the trained decision tree model are used as the explanation of the detection results;

[0014] The detection result corresponding to the network traffic data file to be detected is interpreted and converted into prompt words, the prompt words are input into the large language model, and the response of the large language model is obtained as the diagnosis result.

[0015] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0016] Preferably, the step of constructing a network traffic sample set includes:

[0017] Grab multiple network traffic data files;

[0018] Perform binary classification labeling on the network traffic data file and extract the network traffic feature vector of the network traffic data file;

[0019] Form a network traffic sample set, each sample in the network traffic sample set is represented as ,in Indicates the first samples, Indicates The network traffic feature vector of samples, Indicates Binary classification annotation of samples.

[0020] Preferably, the updating of the network traffic sample set using the multi-hot encoding vector comprises:

[0021] Replace the network flow feature vector of each sample in the network traffic sample set with a multi-hot encoding vector, and the updated sample is represented as ,in Indicates the updated network traffic sample set. samples, Indicates The multi-hot encoded vector of samples.

[0022] Preferably, the method of training the decision tree model using the network traffic sample set includes: based on the network traffic sample set, using a gradient boosting decision tree algorithm to train the decision tree model.

[0023] Preferably, the dimension of the multi-hot encoding vector is the total number of leaf nodes in the trained decision tree model, the order of the components in the multi-hot encoding vector corresponds to the order of the leaf nodes in the trained decision tree model, and the component value corresponding to the leaf node reached by the sample is 1, and the remaining component values ​​are 0.

[0024] Preferably, the step of converting the detection result corresponding to the network traffic data file to be detected into a prompt word comprises:

[0025] Translating the feature name in the test result explanation into a textual explanation;

[0026] Fuzzifying the characteristic values ​​in the interpretation of the detection results;

[0027] Combining the translation result of the feature name and the fuzzification result of the feature value, each decision rule in the explanation of the detection result is converted into a descriptive natural sentence;

[0028] The descriptive natural sentence is converted into a prompt word according to a prompt word template.

[0029] Preferably, the method for fuzzifying the eigenvalues ​​is as follows:

[0030] Get the value range corresponding to the feature;

[0031] The value range is divided into five sub-ranges using the equal-width discretization method;

[0032] The five sub-ranges are sequentially fuzzified into five quantization levels from the minimum value side of the value range to the maximum value side of the value range, and the five quantization levels are very low, low, medium, high and very high.

[0033] The intrusion detection and diagnosis method provided by the present invention, which integrates an interpretable model and a large language model, has the following beneficial effects compared with the prior art:

[0034] (1) By using the decision tree model to give the decision logic, we can clearly see the features and feature value ranges that affect the decision results. On the basis of the decision tree, the logistic regression algorithm is used to further analyze the contribution of the decision rules and extract the decision rules with higher importance as explanatory items, which significantly improves the interpretability of the method.

[0035] (2) Use a large language model to analyze and reason about the output of the interpretable model to obtain diagnostic results that are more readable and more in line with human cognition.

[0036] (3) The output of the interpretable model is converted into prompt words to help the large language model better understand the problem scenario and user intention, thereby avoiding hallucination problems and improving the accuracy of detection and diagnosis. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 The present invention is a flowchart of an intrusion detection and diagnosis method that integrates an interpretable model and a large language model. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0040] like Figure 1 As shown, this embodiment provides an intrusion detection and diagnosis method that integrates an interpretable model and a large language model, which specifically includes the following steps:

[0041] (1) Interpretable model construction: Decision tree plus logistic regression is used to train the interpretable model. The decision tree transforms the original network traffic feature vector into an interpretable decision rule, and the logistic regression performs weight analysis on the decision rule.

[0042] (1-1) Network traffic sample set construction: Collect and annotate network traffic data, and perform feature extraction. The specific steps are as follows:

[0043] (1-1-1) Data collection: Use packet capture tools (such as Wireshark, tcpdump, and nmap) to capture network traffic data and generate a network traffic data file (.pcap file).

[0044] (1-1-2) Data labeling: Network traffic data files are labeled in two categories: normal or abnormal.

[0045] (1-1-3) Feature extraction: Use network traffic analysis tools (such as CICFlowMeter) to parse and analyze network traffic data files and extract network traffic features.

[0046] (1-1-4) Sample set construction: forming a network traffic sample set , each sample in the network traffic sample set is represented as ,in Indicates the first samples, Indicates The network traffic feature vector of samples, Indicates Binary classification annotation of samples.

[0047] (1-2) Decision rule learning: Use the network traffic sample set to train the decision tree model and extract the branch path of the trained decision tree model as the decision rule. The specific steps are as follows:

[0048] (1-2-1) Decision tree model training: based on network traffic sample set , a decision tree model is trained using the GBDT algorithm (GBDT (Gradient Boosting Decision Tree), which is a decision tree-based ensemble learning algorithm that improves the accuracy of the overall classifier by continuously iterating weak classifiers (usually decision trees)) , decision tree model is a binary classification model.

[0049] It is easy to understand that this embodiment trains the decision tree model based on the GBDT algorithm In other embodiments, training may also be performed based on other decision tree algorithms.

[0050] (1-2-2) Decision rule mining: decision tree model Depend on The decision tree consists of multiple branch paths from the root node to the leaf node. The number of branch paths is equal to the number of leaf nodes. Each branch path corresponds to a decision rule. Each decision rule is a logical AND operation of a series of expressions, which can explain the nature of the network traffic data. For example, a decision rule is: [count > 30] && [dst_host_srv_serror_rate < 0.2] && [src_bytes > 5000].

[0051] (1-3) Intrusion detection model construction: The intrusion detection model is a binary classification model, which inputs the network traffic feature vector , output the binary classification results (normal / abnormal) and several related decision rules. The specific steps are as follows:

[0052] (1-3-1) Construction of multi-hot encoding feature sample set: Input each sample in the network traffic sample set into the trained decision tree model, construct a multi-hot encoding vector based on the leaf node of the decision tree in the decision tree model where the sample arrives, and use the multi-hot encoding vector to update the network traffic sample set.

[0053] For network traffic sample set Each sample in , input it into the trained decision tree model ,sample Will arrive at the decision tree model Contains a leaf node of each decision tree, and gets leaf nodes, according to this The order of leaf nodes in the corresponding decision tree constructs a multi-hot encoding vector , a multi-hot encoded vector The dimension of the decision tree model The total number of leaf nodes in , multi-hot encoded vector The order of components and decision tree model The order of the leaf nodes in the , and the component value corresponding to the leaf node reached by the sample is 1, and the remaining component values ​​are 0.

[0054] Replace the network flow feature vector of each sample in the network traffic sample set with a multi-hot encoding vector, and the updated sample is represented as ,in Indicates the updated network traffic sample set. samples, Indicates The multi-hot encoded vector of samples, Indicates The binary classification annotation of samples. The updated network traffic sample set is used as the multi-hot encoding feature sample set. For the GBDT algorithm, the apply function is used to return the leaf node information of each sample in each tree. If other algorithms are used, the corresponding function is used to obtain the leaf node information of the sample in each tree.

[0055] For example, suppose a sample Through the decision tree model , reaching the third leaf node of the first decision tree and the first leaf node of the second decision tree. If the decision tree model There are two decision trees and each decision tree has 3 leaf nodes, so the sample The corresponding multi-hot encoded vector is [0, 0, 1, 1, 0, 0].

[0056] (1-3-2) Intrusion detection model training: Based on the updated network traffic sample set, a binary classification model is trained using the logistic regression algorithm. As an intrusion detection model. The logistic regression model is a linear weighted model, so the binary classification model In addition to outputting binary classification results (normal / abnormal), you can also output multi-hot encoding vectors The weight of each component in . In this embodiment, the combination of the decision tree model and the binary classification model is used as an interpretable model.

[0057] (2) Real-time intrusion detection and interpretation: For the network traffic data file to be detected, GBDT plus logistic regression algorithm is used to output the detection results and several decision rules with the highest weights. , Indicates the real-time acquisition of The detailed steps of real-time intrusion detection and interpretation are as follows:

[0058] (2-1) Feature extraction: Use network traffic analysis tools (such as CICFlowMeter) to extract features from network traffic data files. Extract the network traffic feature vector from the network to obtain the network traffic feature vector to be detected .

[0059] (2-2) Intrusion detection: First, the network traffic feature vector to be detected is Input decision tree model , get the network traffic feature vector to be detected The corresponding multi-hot encoded vector to be tested ; Then, the multi-hot encoding vector to be detected Input binary classification model , get the network traffic data file to be detected The corresponding binary classification results (normal / abnormal) and the multi-hot encoding vector to be tested The weight of each component in .

[0060] (2-3) Explanation of test results: First, find the binary classification model The multi-hot encoded vector to be detected Give the highest weight to the non-zero components; then, find this The leaf nodes corresponding to the non-zero components; finally, find The branch paths corresponding to the leaf nodes in the corresponding decision tree. The decision rules corresponding to these K branch paths are the explanation of the test results, recorded as .

[0061] The GBDT algorithm used in this embodiment can give the decision logic through the decision path, that is, the features and feature value ranges that affect the decision results can be clearly seen. And on the basis of the GBDT algorithm, logistic regression is used to further analyze the contribution of these decision rules, and the weight value of logistic regression is used to reflect the importance of different decision paths. Some decision rules with higher importance are extracted as explanatory items to effectively improve the overall interpretability of the method.

[0062] (3) Intrusion detection result diagnosis: The detection result explanation corresponding to the network traffic data file to be detected is converted into prompt words, and then input into the large language model to obtain the diagnosis result. Given a detection result explanation of a network traffic data file classified as abnormal ,The detailed steps of intrusion detection result diagnosis are as follows:

[0063] (3-1) Prompt word generation: Explain the test results Convert it into a prompt word for the large model. The specific steps are as follows:

[0064] (3-1-1) Feature name translation: For public datasets, use the official documentation to translate each feature name. For example, sbytes is translated as "the total number of bytes sent in a network connection", and ct_srv_dst is translated as "the number of connections to the same target host". For custom features, you can provide explanations for each feature based on expert prior knowledge. The purpose is to explain the detection results. The feature names in are translated into literal explanations.

[0065] (3-1-2) Fuzzification of feature values: Fuzzify the specific feature values ​​into textual expressions. This embodiment provides a fuzzification method as follows: obtain the value range corresponding to the feature; use the equal-width discretization method to divide the value range into 5 sub-ranges; fuzzify the 5 sub-ranges from the minimum value side of the value range to the maximum value side of the value range into 5 quantization levels, and the 5 quantization levels are very low, low, medium, high and very high. For example, if the value of a feature is 3 and its value range is [1,10], then the 5 sub-ranges obtained by division are [1,2], [3,4], [5,6], [7,8], [9,10], and the quantization levels corresponding to these 5 sub-ranges are very low, low, medium, high and very high, respectively, then the feature value of 3 is fuzzified to low.

[0066] (3-1-3) Decision rule conversion: Combine the translation results of the feature names and the fuzzification results of the feature values ​​to convert each decision rule in the detection result interpretation into a descriptive natural sentence. Since the feature names have been translated and the feature values ​​have been fuzzified in steps (3-1-1) and (3-1-2), step (3-1-3) mainly combines the translation results and fuzzification results of the first two, and converts the brackets, connectors, etc. in the decision rules into text or punctuation marks.

[0067] For example, the decision rule "[count > 30] && [dst_host_srv_serror_rate < 0.2] && [src_bytes > 5000]" can be translated into "the number of connections with the same destination host as the current connection is high, the destination host SYN (Synchronize Sequence Numbers) error connection rate is low, and the number of bytes sent from the source host to the destination host is high." The transformed descriptive natural sentence is recorded as .

[0068] (3-1-4) Prompt word generation: Generate descriptive natural sentences based on the prompt word template Converted into prompt words, this embodiment provides a prompt word template as follows (the ellipsis in the prompt word template indicates the content of the descriptive natural sentence):

[0069] As a network security AI assistant, your task is to describe the sentence based on the characteristics of the network traffic sample. , answer the following questions:

[0070] * Analyze whether the network traffic sample is normal traffic or malicious traffic;

[0071] * If it is malicious traffic, please determine its attack type and give an explanation;

[0072] *For the attack type, please give a reasonable solution.

[0073] =“………………”.

[0074] (3-2) Problem diagnosis based on the big model: input the prompt words into the big model and obtain the response of the big model as the diagnosis result.

[0075] For example, a descriptive natural sentence is recorded as The content is: the time to live (TTL) from the source host to the destination host is very high, the number of packet losses at the source host is low, the number of bytes received by the destination host is small, the interaction frequency in data transmission between hosts is very low, the total amount of data sent by the source host to the destination host is at a medium level, and the time to live number of the destination host port is very low, suggesting that a few ports are accessed frequently.

[0076] The prompt words obtained after conversion are as follows:

[0077] As a network security AI assistant, your task is to describe the sentence based on the characteristics of the network traffic sample. , answer the following questions:

[0078] * Analyze whether the network traffic sample is normal traffic or malicious traffic;

[0079] * If it is malicious traffic, please determine its attack type and give an explanation;

[0080] *For the attack type, please give a reasonable solution.

[0081] = "The time to live (TTL) from the source host to the destination host is very high, the number of packet losses at the source host is low, the number of bytes received by the destination host is small, the frequency of interaction in data transmission between hosts is very low, the total amount of data sent by the source host to the destination host is at a medium level, and the time to live number of the destination host port is very low, suggesting that a few ports are accessed frequently."

[0082] The diagnostic results obtained after inputting the prompt words into the large language model are as follows:

[0083] Low frequency of interactions in data transfers between hosts: This may indicate infrequent communication activity, which in some cases may be a sign of backdoor activity, which often attempts to reduce the probability of detection.

[0084] The total amount of data sent from the source host to the destination host is moderate: This is unlikely to be a DoS attack, as DoS attacks usually attempt to overwhelm the target system with large amounts of data.

[0085] The destination host port survival times are very low, suggesting that a few ports are accessed frequently: this is a typical backdoor behavior feature, and backdoor attacks may only use certain specific ports for communication.

[0086] Taking all of the above characteristics into consideration, especially the low frequency of interactions and repeated access to a few specific ports, these signs are most consistent with the characteristics of a backdoor attack.

[0087] Solution: Monitor and block abnormal ports: Check whether the frequently accessed ports have legitimate reasons for communication. If not, these ports should be blocked immediately.

[0088] Enhance intrusion detection system (IDS) rules: Regularly update IDS rules to include detection of such rare port access patterns.

[0089] Perform system audits and cleanups: Check the hosts involved to look for possible implanted backdoors or other malware.

[0090] Enhanced network monitoring: Monitor network traffic and host behavior in real time, and use advanced methods such as machine learning to improve the accuracy and efficiency of anomaly detection.

[0091] According to the above examples, it can be seen that the construction of the interpretable model of the present invention uses the model stacking of the GBDT algorithm plus the logistic regression algorithm, and the model only performs binary classification processing on the traffic. The model only gives the judgment explanation of normal and offensive data. The specific type detection method of the present invention delivers the binary explanation items to the large language model for diagnosis. The present invention makes the judgment of intrusion detection faster and more detailed by using the huge knowledge base of the large language model and manual fine-tuning.

[0092] In order to further demonstrate the advantages of the method of the present invention, the present invention uses the public TON_IoT dataset and UNSW_NB15 dataset for experiments. In the experiments, the method of the present invention is the experimental group, and the method of directly inputting the original data in the dataset into the large language model for diagnosis is used as the control group. The experimental results are shown in Table 1.

[0093] Table 1 Experimental results

[0094] Dataset Group Accuracy ToN_IoT Control group 0.16 ToN_IoT Experimental Group 0.625 UNSW_NB15 Control group 0.18 UNSW_NB15 Experimental Group 0.45

[0095] As can be seen from Table 1, the accuracy of diagnosis by the large language model using the explanation items obtained after the interpretable model training of the present invention is much higher than the accuracy of attack type recognition when the large language model is directly asked questions using the original data in the data set. It can be seen that the present invention has obvious advantages.

[0096] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0097] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. An intrusion detection and diagnosis method integrating an interpretable model and a large language model, characterized in that: The intrusion detection and diagnosis method integrating the interpretable model and the large language model includes: Construct a network traffic sample set, use it to train a decision tree model, and extract the branch path of the trained decision tree model as the decision rule; Input each sample in the network traffic sample set into the trained decision tree model, construct a multi-hot encoding vector according to the leaf node of the decision tree in the decision tree model where the sample arrives, and use the multi-hot encoding vector to update the network traffic sample set; Based on the updated network traffic sample set, a binary classification model is trained using a logistic regression algorithm, wherein the output of the binary classification model includes a binary classification result and a weight of each component in a multi-hot encoding vector; Acquire a network traffic data file to be detected, and extract a network traffic feature vector of the network traffic data file to be detected, to obtain a network traffic feature vector to be detected; Inputting the network traffic feature vector to be detected into the trained decision tree model to obtain the multi-hot encoding vector to be detected, and inputting the multi-hot encoding vector to be detected into the binary classification model to obtain the binary classification result corresponding to the network traffic data file to be detected and the weight of each component in the multi-hot encoding vector to be detected; Take the top weight of the multi-hot encoding vector to be tested non-zero components, determine the front The leaf nodes corresponding to the non-zero components are The decision rules corresponding to the branch paths of leaf nodes in the trained decision tree model are used as the explanation of the detection results; The detection result corresponding to the network traffic data file to be detected is interpreted and converted into prompt words, the prompt words are input into the large language model, and the response of the large language model is obtained as the diagnosis result.

2. The intrusion detection and diagnosis method integrating an interpretable model and a large language model according to claim 1, characterized in that: The constructing of the network traffic sample set includes: Grab multiple network traffic data files; Perform binary classification labeling on the network traffic data file and extract the network traffic feature vector of the network traffic data file; Form a network traffic sample set, each sample in the network traffic sample set is represented as ,in Indicates the first samples, Indicates The network traffic feature vector of samples, Indicates Binary classification annotation of samples.

3. The intrusion detection and diagnosis method integrating an interpretable model and a large language model according to claim 2, characterized in that: The method of updating the network traffic sample set using the multi-hot encoding vector includes: Replace the network flow feature vector of each sample in the network traffic sample set with a multi-hot encoding vector, and the updated sample is represented as ,in Indicates the updated network traffic sample set. samples, Indicates The multi-hot encoded vector of samples.

4. The intrusion detection and diagnosis method integrating an interpretable model and a large language model according to claim 1, characterized in that: The method of training the decision tree model by using the network traffic sample set includes: based on the network traffic sample set, using a gradient boosting decision tree algorithm to train the decision tree model.

5. The intrusion detection and diagnosis method integrating an interpretable model and a large language model according to claim 1, characterized in that: The dimension of the multi-hot encoding vector is the total number of leaf nodes in the trained decision tree model. The order of the components in the multi-hot encoding vector corresponds to the order of the leaf nodes in the trained decision tree model, and the component value corresponding to the leaf node reached by the sample is 1, and the remaining component values ​​are 0.

6. The intrusion detection and diagnosis method integrating an interpretable model and a large language model according to claim 1, characterized in that: The step of converting the detection result corresponding to the network traffic data file to be detected into a prompt word includes: Translating the feature name in the test result explanation into a textual explanation; Fuzzifying the characteristic values ​​in the interpretation of the detection results; Combining the translation result of the feature name and the fuzzification result of the feature value, each decision rule in the explanation of the detection result is converted into a descriptive natural sentence; The descriptive natural sentence is converted into a prompt word according to a prompt word template.

7. The intrusion detection and diagnosis method integrating an interpretable model and a large language model according to claim 6, characterized in that: The method of fuzzifying the eigenvalues ​​is as follows: Get the value range corresponding to the feature; The value range is divided into five sub-ranges using the equal-width discretization method; The five sub-ranges are sequentially fuzzified into five quantization levels from the minimum value side of the value range to the maximum value side of the value range, and the five quantization levels are very low, low, medium, high and very high.

Images