Optimization method for network attack information interpretation and judgment based on CoT driving

Abstract

An optimization method for network attack information explanation and judgment based on CoT driving is provided, a CoT learning template is provided for a given prompt, the explanations generated by multiple model CoTs are respectively modified through adaptive iterative detection, semantic precision and deviation control, and similarity based on rule template matching, and are fused and iteratively modified and optimized, and a standard gold label is combined for comprehensive judgment, so that the CoTs of different models continuously learn and improve their explanation ability, gradually improve the accuracy and quality of the explanation, and finally maintain the answers generated by the CoTs of different models in a balanced state, so as to make up for the shortcomings of a single model and improve the overall performance. Through the above method, the present application can effectively solve the problems of incomplete and inaccurate information in the explanation answers generated by the existing model for network attack information.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network security, and particularly relates to an optimization method of network attack information interpretation and judgment based on CoT driving. BACKGROUND

[0002] With a large number of unknown types of network attacks existing in life and becoming increasingly complex, the traditional interpretation algorithm cannot well interpret them. The optimization method of network attack information interpretation and judgment based on CoT driving has shown its unique advantages. Through the deep integration of the CoT analysis capability of a large model and network attack scenarios, the method has shown innovative advantages. It not only enhances the interpretation capability of unknown network attack information, but also opens up a new path for intelligent interpretation of unknown network attacks. At present, the data set of network attack information interpretation is relatively lacking due to the problems of great collection difficulty and the emergence of new types of attacks, such as fileless attacks of advanced persistent threats APT, SolarWinds supply chain attacks, etc. The training effect of traditional security detection algorithms in interpreting these network attack information is not ideal.

[0003] The traditional network attack information interpretation algorithm mainly interprets known attack information, and cannot effectively interpret a large number of unknown network attack information emerging in daily network life. These traditional algorithms often rely on rules or features designed for different types of attack information, and are limited to static interpretation of fixed keyword pattern matching, which is difficult to have universality and applicability, and the workload is huge. Although the traditional method can query known network security words in the word library, it cannot identify "customized" words and non-fixed fields. These non-standard words are difficult to quantify and analyze in a standard way, which can mislead the traditional network security attack information interpretation algorithm and reduce the interpretation accuracy. In addition, the traditional method is difficult to capture complex context and implicit information, and cannot fully understand the intention and motivation behind the attack information. Building and maintaining a large keyword library and corresponding rules requires a large amount of human resources, and needs to be adjusted manually, which will reduce the interpretation quality of the emerging network attack information.

[0004] CoT has good adaptability and universality in interpreting different types of attack information and the "customized", "non-standard" vocabulary in network attack traffic, and can handle various complex attack behaviors and contexts. Compared with traditional algorithms, CoT has excellent context understanding and the ability to handle complex contexts, and can propose security risks and protection suggestions exposed by the current attack information in a humanized way. CoT is not limited by the static interpretation of the fixed pattern matching of keywords in traditional algorithms, and the diversified and expressive text makes the interpretation of network attack information more vivid and intuitive. This generative interpretation is very friendly to non-professional operation and maintenance personnel to understand a large amount of complex network attack information, and greatly reduces the research and development and operation and maintenance costs. Due to its strong generalization ability and iterative correction and learning, CoT can better adapt to new attack information without frequent model or algorithm updates.

[0005] However, there are some shortcomings in the answers generated by CoT in some aspects: first, in terms of information integrity and standardization, although the generated explanations are diverse and expressive, they may sometimes fail to fully cover all relevant important key information points, especially when the attack technology is novel or complex, and key details are easily missed. Second, in terms of semantic accuracy and bias control, when dealing with special vocabulary or more complex attack methods, the large model may misinterpret the context, leading to output explanations that do not match the semantics of the original attack information, such as normal activities being mistaken for attack behaviors. At the same time, due to the limitations or imbalance of the training data, or overgeneralization, the large model may ignore special situations in certain contexts, resulting in inaccurate understanding of some attack behaviors, and the answers generated by the large model may be inaccurate in key details; third, in terms of rule consistency, the diversity of the large model CoT may lead to neglect of the importance of organizing key information according to the preset template, which may result in inconsistency and confusion in the output format, especially in scenarios that require standardized reporting or highly structured information. Therefore, this to some extent increases the difficulty of the operability of operation and maintenance personnel to quickly respond to and understand the information, SUMMARY

[0006] In order to solve the problems of the prior art, the present application proposes an optimization method for network attack information interpretation and evaluation based on CoT driving, which can effectively solve the problems of unknown network attack information interpretation, efficient screening and evaluation of optimal interpretation, etc.

[0007] The present application is realized by the following technical scheme: an optimization method for network attack information interpretation and evaluation based on CoT driving, the steps of which are:

[0008] Step 1: Develop prompt as input template for selected model M n (n = 1, 2, 3...);

[0009] Divide the dataset D into k groups of datasets d with every 10 attack samples as the standard k , Y k =(E i * , A i * ) as the gold label, and set a high-quality prompt: <Y k , Q> as the input for selecting different models;

[0010] Among them, Y[[ID=十七]] k ∈d k , k = 1, 2, 3...; E i * is the CoT standard explanation part of the i-th attack information; A i * is the standard answer part of the i-th attack information; Q is the new network attack information.

[0011] Step 2 Obtain the corresponding text answer (E n , A i ) of the model output through the CoT ability of model M i , where i = 1, 2, 3..., E i is the CoT explanation part, and A<eis the finally obtained answer part;

[0012] Select model M n (n = 1, 2, 3, 4...), and input the prompt to model M n in turn, and obtain the text answer (E n , A i ) output by model M i after CoT, where E i represents the CoT explanation part, and A i is the finally obtained answer part. The specific method is as follows:

[0013] Input the prompt to model M1 (ChatGPT), and output (E1, A1); input it to model M2 (ERNIE Bot), and output (E2, A2); input it to model M3 (Zhipu AI), and output (E3, A3); input it to model M4 (Tongyi Qianwen), and output (E4, A4); and so on. Input the prompt to model M n , and output (E i , A<00000s).

[0014] Step 3 For each model M n generated (E i , A iThe text is encoded using the all-MiniLM-L6-v2 model to generate a multidimensional spatial vector code V. i (i = 1, 2, 3...);

[0015] Each model M n The generated (E) i A i All of these belong to the category of text. To ensure that these texts can be used as variables in the composite similarity evaluation criterion function, the all-MiniLM-L6-v2 model is used to encode the texts and generate a spatial encoding vector V that can be understood by a computer. i (i = 1, 2, 3...), the encoding calculation formula is as follows:

[0016] V i =Encode all-MiniLM (E i A i )

[0017]

[0018] in:

[0019] V i The multidimensional space vector encoding of (Ei,Ai) generated for model Mn is output after encoding;

[0020] V * The golden label Y ~ (E) provided for dataset D * A * The multidimensional space vector encoding output after encoding.

[0021] Step 4 uses an adaptive iterative detection algorithm function with information correction to check (E) i A i Iterative retrieval and completion of information completeness are performed to obtain the matching score S. km ;

[0022] The adaptive iterative detection algorithm S with information correction km (V i V * The algorithm calculates the proportion of times a specified feature appears in the total number of mentions, measures the degree of matching between the features in the two texts, and iterates through (Ei,Ai) to retrieve and complete the information integrity until the maximum number of iterations is reached or all features f have been retrieved, at which point the iteration ends.

[0023] Calculate the matching score S km The specific calculation formula is as follows:

[0024]

[0025] wherein,

[0026] F is a feature set list of the information correction adaptive iterative detection algorithm, including attack time, attack IP, attack port, attack type;

[0027] N match (V i ,V * ,f) represents the number of co-occurrences of feature f (f∈F) in V i and V * ;

[0028] N total (V i ,f), N total (V * ,f) respectively represent the total number of mentions of feature f in V i and V * .

[0029] Step 5 calculates the model M n output (E i ,A i ) and the semantic similarity between the gold label Y~(E * ,A * ) given by the data set D, and obtains the matching score S sm .

[0030] Step 5 calculates the model M n output (E i ,A i ) and the semantic similarity between the gold label Y~(E * ,A * ) given by the data set D, and obtains the semantic similarity score S sm (V i ,V * ).

[0031] First, determine the representative word list or phrase about the feature after preprocessing, for a certain feature, use the pre-trained word embedding model, calculate the average semantic similarity score of the text given by the model and the gold label on the feature, and then take the weighted average for all features in the feature set as the overall semantic similarity score: the specific calculation formula is as follows:

[0032]

[0033] wherein,

[0034] T is a fuzzy semantic feature set, including ip, time, port, protocol, intent, feature ≠ keyword;

[0035] and are V i and V * respectively, the representative vocabulary list of feature t in V

[0036] represents the average semantic similarity score of the word w and all related words of feature t in V * .

[0037] λ t is the semantic weight of feature t, used to adjust the relative importance of different features in semantic similarity calculation.

[0038] Step 6 calculates the model M n output (E i , A i ) and the template matching degree of the gold label Y provided by the data set D (E * , A * ), and gets the matching score S tm . Set threshold g3, g3 is the threshold of the rule-based template matching similarity algorithm, if S tm < g3, then let the model M n regenerate (E i , A i ) according to the template of the gold label Y.

[0039] Step 6 calculates the model M n output (E i , A i ) and the template matching degree of the gold label Y provided by the data set D (E * , A * ), and gets the matching score S tm . Set threshold g3, if S tm < g3, then let the model M n regenerate (E i , A i ) according to the template of the gold label Y.

[0040] The specific calculation formula is as follows:

[0041]

[0042] wherein,

[0043] is the number or proportion of templates in V i and V * that match the feature f

[0044] μ f is the template matching weight of feature f, used to adjust the relative importance of different features in template matching.

[0045] C is the expression template of feature f.

[0046] Step 7 constructs a composite similarity evaluation criterion by the information-corrected adaptive iterative detection algorithm, the semantic accuracy and deviation control algorithm, and the similarity algorithm based on rule template matching, to obtain the output of model M n and the evaluation total score S * (i = 1, 2, 3...) of the golden label Y~(E * ,A i ).

[0047] First, a composite similarity evaluation criterion is constructed by the information-corrected adaptive iterative detection algorithm, the semantic accuracy and deviation control algorithm, and the similarity algorithm based on rule template matching, to obtain the output of model M n and the evaluation total score S * (i = 1, 2, 3...) of the golden label Y~(E * ,A i ).

[0048] The specific calculation formula is as follows:

[0049] S i = W km S km (V i ,V * )+W sm S sm (V i ,V * )+W tm S tm (V i ,V * )

[0050] Wherein,

[0051] S i is the composite similarity evaluation score;

[0052] W km , W sm , W tmrespectively, are based on information correction adaptive iterative detection, semantic accuracy and deviation control, and weight based on rule template matching, reflecting the relative importance of each matching method in the overall similarity evaluation, and meeting:

[0053] W km +W sm +W tm =1

[0054] Step 8 judges whether Si exceeds threshold G, G is a threshold for judging whether the overall composite similarity evaluation score S i reaches the ideal requirement, if S i <G, repeat steps 5-7 to perform a new round of iteration, if the iteration number > 5, or there is S i >G, the iteration ends;

[0055] Set threshold G to judge whether the composite similarity evaluation score S i exceeds threshold G, if S i <G (convergence), repeat the information correction adaptive iterative detection, semantic accuracy and deviation control, and similarity iteration process based on rule template matching, if the iteration number > 5, or there is S i >G, the iteration ends.

[0056] Step 9 starts the transverse comparison between models M n , calculates the difference d i between the scores S i of the models M n , if d i converges to threshold g, g is a threshold for describing the transverse comparison between the models M n , at this time, the (E i , A i ) generated by each model M n tends to be stable, and the accuracy reaches the peak, at this time, the (E i , A i ) corresponding to the highest score S max of the model is taken as the most reliable answer, and finally as the standard answer is output to the user.

[0057] The transverse level comparison of the composite similarity evaluation score between the models M n is performed, that is, the difference d i between the scores S i of the models M n to the same attack information is calculated.

[0058] Set threshold g, if d i >g∪d i <g, at this time, the (E i , Ai ) the standard historical data set is input to the model M as a reference n for correction; if d i converges to the threshold g, it is determined that at this time each model M n generated (E i , A i ) tends to be stable, and the accuracy of all models M n reaches a peak, at which time the score S max corresponding to the (E i , A i ) with the highest model score is output as a reliable standard answer to the user.

[0059] The beneficial effects of the present application are: an optimization method for network attack information interpretation and judgment based on CoT driving is proposed. This method uses the CoT capability of large models to interpret network attack information and selects the optimal interpretation to display to the operation and maintenance personnel. This enables non-network security professionals to effectively handle a large number of unknown attacks in daily network life, including unknown types and unknown key information. This method reduces the interference of self-defined and non-standard vocabulary on interpretation, while having excellent context understanding and context processing capabilities, and can specifically propose hidden dangers and protection measures exposed by the current attack information. On the other hand, CoT can generate diverse and expressive text, which is not limited by the static interpretation of traditional algorithm fixed pattern matching. This method has strong generalization ability and can better adapt to new attack information through continuous iterative correction and learning, without the need to frequently update models or algorithms. This saves research and development costs and reduces resource investment requirements, and only high-quality sample data needs to be ensured to obtain ideal output. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 is the overall flow of the present application;

[0061] Figure 2 is a composite similarity evaluation standard framework diagram. DETAILED DESCRIPTION

[0062] The optimization method for network attack information interpretation and judgment based on CoT driving includes the following steps:

[0063] The present application will be specifically described in conjunction with the drawings.

[0064] The network attack information interpretation optimization algorithm flow is shown in Figure 1 , which includes specific algorithm detail flow:

[0065] 1. Set the input template.

[0066] (1) Divide the dataset D into k groups of datasets d with every 10 attack samples as a standard. k , Y k = (E i * , A i * ) as the golden label.

[0067] (2) Set the prompt: <Y k , Q>

[0068] Among them,

[0069] Y k ∈ d k , k = 1, 2, 3...;

[0070] E i * is the CoT standard explanation part of the i-th attack information;

[0071] A i * is the standard answer part of the i-th attack information;

[0072] Q is the new network attack information.

[0073] 2. Select the model M n (n = 1, 2, 3, 4...), and input the prompt to the model M n in turn, and obtain the (E n , A i , A i ) output by the model M after CoT.

[0074] Input the prompt to the model M1 (ChatGPT), and output (E1, A1);

[0075] Input the prompt to the model M2 (ERNIE Bot), and output (E2, A2);

[0076] Input the prompt to the model M3 (Zhipu AI), and output (E3, A3);

[0077] Input the prompt to the model M4 (Tongyi Qianwen), and output (E4, A4); ......

[0079] Input the prompt to the model M n , and output (E i , A i )

[0080] Among them,

[0081] E iis the interpretation part of CoT;

[0082] A i is the final answer part.

[0083] 3. Text encoding

[0084] Each model M n generates (E i ,A i ) which belongs to the category of text. In order to input it as a variable into the composite similarity evaluation criterion function, it needs to be encoded by the all-MiniLM-L6-v2 model to generate a spatial encoding vector V i (i = 1, 2, 3...) which encoding calculation formula is as follows:

[0085] V i = Encode all-MiniLM (E i ,A i )

[0086] V * = Encode all-MiniLM (E * ,A * )

[0087] Wherein:

[0088] V i is the multi-dimensional space vector encoding output by the Encode of (E i ,A i ) generated by the model M n ;

[0089] V * is the multi-dimensional space vector encoding output by the Encode of the golden label Y~(E * ,A * ) provided by the data set D;

[0090] 4. Information correction adaptive iterative detection algorithm.

[0091] (1) First, calculate the proportion of the number of occurrences of the specified feature in the total number of mentions by the information correction adaptive iterative detection algorithm S km (V i ,V * ), to measure the matching degree of the feature in the two texts.

[0092] (2) In an iterative manner, (E i ,A i) The information integrity is searched and completed until the maximum iteration number is reached or all features f are searched, and the iteration ends.

[0093] (3) Calculate the matching score S km The specific calculation formula is as follows:

[0094]

[0095] Wherein,

[0096] F is a feature set list (such as attack time, attack IP, attack port, etc.);

[0097] N match (V i ,V * ,f) represents the number of common occurrences of feature f (f∈F) in V i and V * .

[0098] N total (V i ,f), N total (V * ,f) respectively represent the total number of mentions of feature f in V i and V * .

[0099] 5. Semantic accuracy and deviation control algorithm

[0100] (1) Calculate the model M n Output (E i ,A i ) and the semantic similarity between the data set D given gold label Y~(E * ,A * ), get semantic similarity score S sm (V i ,V * ).

[0101] (2) Determine the representative word list or phrase about the feature after preprocessing, for a certain feature, use the pre-trained word embedding model, calculate the average semantic similarity score of the text given by the model and the gold label on the feature, then take the weighted average of all features in the feature set as the overall semantic similarity score, The specific calculation formula is as follows:

[0102]

[0103] Wherein,

[0104] T is the fuzzy semantic feature set ({ip, time, port, protocol, intent}), (features ≠ keywords, same semantics)

[0105] and are V i and V * respectively

[0106] represents the average semantic similarity score of the word w and the feature t with all related words in V * (using pre-trained word embedding model)

[0107] λ t is the semantic weight of the feature t, used to adjust the relative importance of different features in semantic similarity calculation.

[0108] 6. Similarity algorithm based on rule template matching.

[0109] (1) Calculate the model M n output by the similarity algorithm based on rule template matching (E i , A i ) and the number or proportion of matching templates of the gold label Y provided by the data set D (E * , A * ), take the weighted average of all feature template matching scores as the overall template matching score to get the matching score S tm (V i , V * ), set the threshold g3, if S tm < g3, let the model M n regenerate (E i , A i ) according to the template of the gold label Y;

[0110] (2) The specific calculation formula is as follows:

[0111]

[0112] where,

[0113] is the number or proportion of matching templates of the feature f in V i and V *

[0114] μ f is the template matching weight of the feature f, used to adjust the relative importance of different features in template matching.

[0115] ​C is the expression template of feature f, such as "attack IP: X", "attack time: YY-MM-DD", etc.

[0116] 7. Construct a composite similarity evaluation criterion.

[0117] (1)共同构建复合相似度评判标准,得到模型M的输出与黄金标签Y~(E n ,A * ,A * )的评判总分S i (i = 1, 2, 3...).

[0118] (2) The specific calculation formula is as follows:

[0119] S i = W<oo00259>S km (V i , V * ) + W sm S sm (V i , V * ) + W tm S tm (V i , V * )

[0120] Where,

[0121] S i is the composite similarity evaluation score;

[0122] W km , W sm , W<000027t>are the weights of the adaptive iterative detection algorithm for information correction, the control algorithm for semantic accuracy and deviation, and the similarity algorithm based on rule template matching, respectively, reflecting the relative importance of each matching method in the overall similarity evaluation, and satisfying:

[0123] W km + W sm + W tm = 1

[0124] 8. Iteration end condition.

[0125] First, set a threshold G, and judge whether the composite similarity evaluation score S i exceeds the threshold G. If S<00oo279>< G (convergence), then repeat the iterative processes of information integrity, semantic similarity, and rule template matching respectively. If the number of iterations > 5, or there exists S i > G, then the iteration ends. It should be noted that there are some possible errors in the original text such as "oo00259" and "oo00279" which are likely incorrect notations. I have translated them as they are for the purpose of following the translation rules strictly. You may want to check and correct these in the original text if possible.

[0126] 9. Cross-level comparison.

[0127] (1) Perform model M n 's cross-level comparison, i.e. calculate the difference d i between the composite similarity evaluation scores of model M n 's interpretation of the same attack information. i ;

[0128] (2) Set a threshold value g, if d i > g U d i < g, at this time the fluctuation difference of (E i , A i ) output by different models is large, input the standard historical data set to the model M n for correction; if d i converges to the threshold value g, it is determined that at this time the (E i , A i ) generated by each model M n tends to be in a stable state, and the accuracy of all models M n reaches a peak, and finally take the (E i , A i ) corresponding to S max as the reliable standard answer output to show to the user.

Claims

1. An optimized method for interpreting and evaluating network attack information based on CoT (CoT-driven) is characterized in that, The steps are as follows: Step 1: Define the prompt as the selected model M n The input template, n = 1, 2, 3...; Divide the dataset D into k datasets d based on every 10 attack samples. k Y k =(E i * A i * As a gold standard, set a high-quality prompt: <Y k Q> serves as the input for selecting different models; Among them, Y k ∈d k k = 1, 2, 3...; E i * This is the CoT standard interpretation part of the i-th attack message; A i * This represents the standard answer portion of the i-th attack message; Q represents new network attack information. Step 2 using model M n The CoT capability obtains the text answer corresponding to the model output (E). i A i ), where i=1,2,3...,E i For the explanation of CoT, A i This is the final answer portion; Step 3 For each model M n The generated (E) i A i The text is encoded using the all-MiniLM-L6-v2 model to generate a multidimensional spatial vector code V. i , i = 1, 2, 3...; Step 4 uses an adaptive iterative detection algorithm function with information correction to check (E) i A i Iterative retrieval and completion of information completeness are performed to obtain the matching score S. km (V i V * ); Step 5 calculates model M using a semantic precision and bias control algorithm. n Output (E) i A i ) and the given gold label Y in dataset D k =(E i * A i * Semantic similarity is used to obtain a matching score S. sm (V i V * ); Step 6 calculates model M through a similarity algorithm based on rule template matching n The output of (E i , A i ) and the gold label Y provided by the dataset D k =(E i * , A i * )'s template matching degree, obtaining a matching score S tm (V i , V * ). Set a threshold g3, where g3 is the threshold of the similarity algorithm based on rule template matching. If S tm (V i , V * ) < g3, then make model M n regenerate (E k template according to the gold label Y i , A i ); Step 7 constructs a composite similarity evaluation criterion by combining an adaptive iterative detection algorithm with information correction, a semantic accuracy and bias control algorithm, and a similarity algorithm based on rule template matching, thus obtaining model M. n The output and Y k =(E i * A i * The total score S for judging) i , i = 1, 2, 3...; First, a composite similarity evaluation criterion is constructed by combining an adaptive iterative detection algorithm with information correction, a semantic accuracy and bias control algorithm, and a similarity algorithm based on rule template matching, resulting in model M. n Output and the gold label Y k =(E i * A i * The total score S for judging) i , i = 1, 2, 3...; The specific calculation formula is shown in (6) below: S i =W km S km (V i ,V * )+W sm S sm (V i ,V * )+W tm S tm (V i ,V * ) (6) in, S i To determine the total score; W km W sm W tm These represent the weights for adaptive iterative detection based on information correction, control of semantic accuracy and bias, and rule-based template matching, respectively. These weights reflect the relative importance of each matching method in the overall similarity evaluation and satisfy the following conditions: IN km +W sm +W tm =1; Step 8 determines whether S i exceeds a threshold value G, where G is used to determine whether the total evaluation score S i reaches the ideal requirement. If S i < G, repeat steps 5 to 7 for a new round of iteration. If the number of iterations > 5, or there exists S i > G, the iteration ends; Step 9 begins with model M n Horizontal comparison between them, calculation model M n Score S i The difference d between i If d i It converges to a threshold g, where g is used to describe model M. n The threshold for horizontal comparison between models M, at which point... n The generated (E) i A i The model tends to stabilize and its accuracy reaches its peak. At this point, the highest score S of the model is set. max Corresponding (E) i A i As the most reliable answer, it will ultimately be presented to the user as the standard answer.

2. The optimized method for interpreting and evaluating network attack information based on CoT as described in claim 1, characterized in that, In step 2, the specific method is as follows: Selected model M n n = 1, 2, 3, 4..., the prompt is sequentially input into model M. n Model M is derived. n The text answer (E) output by CoT i A i ), where E i Represented as the explanation part of CoT, A i The specific method for obtaining the final answer is as follows: The prompt input is given to model M1, and the output is (E1, A1); the input is given to model M2, and the output is (E2, A2); the input is given to model M3, and the output is (E3, A3); the input is given to model M4, and the output is (E4, A4); and so on, the prompt input is given to model M... n Output (E) i A i ).

3. The optimized method for interpreting and evaluating network attack information based on CoT as described in claim 1, characterized in that, In step 3, the specific method is as follows: Each model M n The generated (E) i A i All of these belong to the category of text. To ensure that these texts can be used as variables in the composite similarity evaluation criterion function, the all-MiniLM-L6-v2 model is used to encode the texts and generate a spatial encoding vector V that can be understood by a computer. i For i = 1, 2, 3..., the encoding calculation formulas are shown in (1) and (2) below: V i =Encode all-MiniLM (E i ,A i ) (1) V * =Encode all-MiniLM (E * ,A * ) (2) in: V i For model M n The generated (E) i A i The multidimensional space vector encoding output after encoding; V * The golden label Y provided for dataset D k =(E i * A i * The multidimensional space vector encoding output after encoding.

4. The optimized method for interpreting and evaluating network attack information based on CoT as described in claim 1, characterized in that, In step 4, the specific method is as follows: The adaptive iterative detection algorithm S with information correction km (V i V * (Calculate the proportion of times a specified feature co-occurs out of the total number of mentions, measure the degree of feature matching between two texts, and iteratively process (E) i A i The process continues to retrieve and complete information until the maximum number of iterations is reached or all features f have been retrieved, at which point the iteration ends. Calculate the matching score S km (V i V * The specific calculation formula is shown in (3): in, F is a list of features for the adaptive iterative detection algorithm with information correction, including attack time, attack IP, attack port, and attack type; N match (V i V * f(represents V) i and V * The number of common occurrences of feature f, f∈F, N total (V i ,f), N total (V * f) respectively represent the values ​​in V i and V * Total number of mentions of feature f.

5. An optimized method for interpreting and evaluating network attack information based on CoT as described in claim 1, characterized in that, In step 5, the specific method is as follows: Model M is calculated using a semantic precision and bias control algorithm. n Output (E) i A i ) and the given gold label Y in dataset D k =(E i * A i * The semantic similarity between the two pairs is used to obtain the semantic similarity score S. sm (V i V * ); First, determine the representative vocabulary list or phrases for the features obtained after preprocessing. For feature t, use a pre-trained word embedding model to calculate the average semantic similarity score between the text given by the model and the golden label on that feature. Then, take the weighted average of all features in the feature set as the overall semantic similarity score. The specific calculation formula is shown in (4) below: in, T is a set of fuzzy semantic features, including IP, time, port, protocol, and intent. Features are not the same as keywords. and They are V i and V * A list of representative terms related to feature t; Representing the relationship between vocabulary w and feature t in V * The average semantic similarity score of all related words in the text; λ t It is the semantic weight of feature t, used to adjust the relative importance of different features in semantic similarity calculation.

6. The optimized method for interpreting and evaluating network attack information based on CoT as described in claim 1, characterized in that, In step 6, the specific method is as follows: Calculate the model M through a similarity algorithm based on rule template matching n The output of (E i , A i ) and the gold label Y provided by the dataset D k =(E i * , A i * ) is the number or proportion of matching templates, and the weighted average of all feature template matching scores is taken as the overall template matching score to obtain the matching score S tm (V i , V * ). Set the threshold g3. If S tm < g3, then let the model M n regenerate (E k ) according to the template of the gold label Y i , A i ); The specific calculation formula is shown in (5) below: in, Is feature f in V i and V * The number or proportion of matching templates in the text; μ f It is the template matching weight of feature f, used to adjust the relative importance of different features in template matching; C is the template for representing feature f.

7. An optimized method for interpreting and evaluating network attack information based on CoT as described in claim 1, characterized in that, In step 8, the specific method is as follows: Set the threshold G and judge the total score S of the evaluation i Whether it exceeds the threshold G. If S i <G, then converge, and repeat the adaptive iterative detection of information correction, the control of semantic accuracy and deviation, and the similarity iteration process based on rule template matching respectively. If the number of iterations > 5, or there exists S i >G, then the iteration ends.

Images