Task command processing method, device and equipment

Abstract

The embodiment of the invention discloses a task command processing method, device and equipment. The method comprises the steps that a to-be-executed task command is intercepted; generating corresponding command prompt information based on the task command, and inputting the command prompt information into the large language model to obtain behavior description information of the task command; inputting the behavior description information of the task command into an encoder to obtain encoding information corresponding to the behavior description information of the task command; based on the similarity between coding information corresponding to the behavior description information of the task command and coding information corresponding to each piece of benchmark attack technology description information in the technology and tactics knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information; according to the similarity between coding information corresponding to behavior description information of the task command and coding information corresponding to benchmark attack technology description information contained in each benchmark attack tactics in the technology and tactics knowledge base, whether the task command is a command with a preset attack risk or not is judged, and whether the task command continues to be executed or not is judged.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a method, device and equipment for processing task commands. Background Art

[0002] As the cybersecurity situation becomes increasingly severe and people pay more and more attention to their privacy data, the number and types of malicious codes continue to increase, greatly increasing the burden of manual review in security operations. Although intrusion detection systems (IDS) can capture and warn of suspicious malicious codes, security operators face challenges in understanding these malicious codes. In recent years, the development of large language models (LLMs) has made it possible to analyze the techniques and tactics used by malicious codes.

[0003] However, the existing general LLM lacks professional knowledge and produces hallucinations in the malicious code interpretation task. Therefore, how to use the analysis ability of large language models to analyze the techniques and tactics used in malicious code is an important issue that needs to be solved urgently. To this end, it is necessary to provide a better technical solution for analyzing the techniques and tactics used in malicious code using the analysis ability of large language models. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a better technical solution for analyzing the techniques and tactics used by malicious code by utilizing the analysis capabilities of a large language model.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows: A method for processing a task command provided in an embodiment of the present specification comprises: intercepting a task command to be executed. Based on the task command, a corresponding command prompt information is generated, and the command prompt information is input into a large language model to obtain the behavior description information of the task command. The behavior description information of the task command is input into a pre-trained encoder to obtain the encoding information corresponding to the behavior description information of the task command. Based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the task command is a command with a preset attack risk, and an instruction on whether to continue to execute the task command is output based on the judgment result.

[0006] The embodiment of the present specification provides a task command processing device, the device comprising: a command interception module, intercepting the task command to be executed. A behavior description determination module, based on the task command, generates corresponding command prompt information, and inputs the command prompt information into a large language model to obtain the behavior description information of the task command. A first encoding module, inputs the behavior description information of the task command into a pre-trained encoder, and obtains the encoding information corresponding to the behavior description information of the task command. A task command detection module, based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, determines whether the task command is a command with a preset attack risk, and outputs an instruction on whether to continue to execute the task command based on the judgment result.

[0007] The embodiment of the present specification provides a task command processing device, the task command processing device comprising: a processor; and a memory arranged to store computer executable instructions, the executable instructions, when executed, enable the processor to: intercept the task command to be executed. Based on the task command, generate corresponding command prompt information, and input the command prompt information into a large language model to obtain the behavior description information of the task command. Input the behavior description information of the task command into a pre-trained encoder to obtain the encoding information corresponding to the behavior description information of the task command. Based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, judge whether the task command is a command with a preset attack risk, and output an instruction on whether to continue to execute the task command according to the judgment result.

[0008] The embodiment of the present specification also provides a storage medium, which is used to store computer executable instructions, and the executable instructions implement the following process when executed by the processor: intercept the task command to be executed. Based on the task command, generate corresponding command prompt information, and input the command prompt information into the large language model to obtain the behavior description information of the task command. Input the behavior description information of the task command into a pre-trained encoder to obtain the encoding information corresponding to the behavior description information of the task command. Based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, judge whether the task command is a command with a preset attack risk, and output an instruction on whether to continue to execute the task command based on the judgment result.

[0009] The embodiment of the present specification also provides a computer program product, including a computer program, which implements the following process when executed by a processor: intercepting a task command to be executed. Based on the task command, generate corresponding command prompt information, and input the command prompt information into a large language model to obtain the behavior description information of the task command. Input the behavior description information of the task command into a pre-trained encoder to obtain the encoding information corresponding to the behavior description information of the task command. Based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, determine whether the task command is a command with a preset attack risk, and output an instruction on whether to continue to execute the task command based on the judgment result. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings required for use in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor. Figure 1 This is an embodiment of a method for processing a task command in this specification; Figure 2 A schematic diagram of a task command processing process in this specification; Figure 3 Another embodiment of a method for processing a task command in this specification; Figure 4 This is another embodiment of a method for processing a task command of this specification; Figure 5 A schematic diagram of another task command processing process of this specification; Figure 6 A schematic diagram of another task command processing process of this specification; Figure 7 This is an embodiment of a task command processing device of this specification; Figure 8 This is an embodiment of a task command processing device in this specification. DETAILED DESCRIPTION

[0011] The embodiments of this specification provide a method, device and equipment for processing a task command.

[0012] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0013] The embodiments of this specification provide a technical and tactical identification mechanism for malicious commands. As the network security situation becomes increasingly severe, the number and types of malicious codes continue to increase, greatly increasing the burden of manual review in security operations. Although intrusion detection systems can capture and warn of suspicious malicious codes, security operators face challenges in understanding these malicious codes. In recent years, the development of large language models has provided possibilities for the analysis of techniques and tactics used by malicious codes. However, existing general LLMs lack professional knowledge and produce hallucinations in malicious code interpretation tasks. Therefore, how to use the analysis capabilities of large language models to analyze the techniques and tactics used by malicious codes is an important issue that needs to be solved urgently. Usually, a command classifier can be directly constructed, the text of the task command is input into the above classifier, and the probability distribution of each category is output. However, this method relies on training a powerful classifier that can understand the context of the task command and relies on a large amount of labeled data. If the category needs to be expanded, the classifier needs to be retrained. For this reason, the embodiment of this specification utilizes the powerful understanding ability of the large language model for the task command to generate corresponding behavior description information, and directly identifies it from the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier. Moreover, if the category needs to be expanded, it only needs to add the baseline attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, and there is no need to retrain the model. For specific processing, please refer to the specific content in the following embodiment.

[0014] like Figure 1 As shown, an embodiment of this specification provides a method for processing a task command, and the execution subject of the method may be a terminal device or a server, etc., wherein the terminal device may be a mobile terminal device such as a mobile phone, a tablet computer, or a computer device such as a laptop or a desktop computer, or an IoT device (specifically a smart watch, a vehicle-mounted device, etc.), etc., wherein the server may be an independent server, or a server cluster composed of multiple servers, etc., and the server may be a background server in the financial field or the online shopping field, or a background server of an application, etc. In this embodiment, a detailed description is given by taking the execution subject as a server as an example. For the case where the execution subject is a terminal device, please refer to the following server case processing, which will not be repeated here. The method may specifically include the following steps: In step S102, the task command to be executed is intercepted.

[0015] Among them, the task command can be a command that needs to execute one or more tasks. For example, the task command can be a program code at one end, or the task command can be an execution command of an application under a certain execution path, such as "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump(Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full", etc. It can be set according to actual conditions, and the embodiments of this specification are not limited to this.

[0016] In implementation, Figure 2 As shown, when the user needs to execute a task command (i.e. Figure 2 In <command> part), the specific content of the task command can be entered. After the input is completed, the execution process can be triggered. For example, the user can enter the specific content of the task command "wmic shadowcopycall ceate Volume=C:\\" in the command bar of the resource manager in the Windows operating system computer. After the input is completed, you can click the "Enter" button on the keyboard or click the OK icon (or OK button) or the Go icon (or Go button) in the command bar to trigger the execution process. At this time, the task command entered by the user can be intercepted, and the task command entered by the user can be determined as the task command to be executed, thereby realizing the interception of the task command to be executed.

[0017] In step S104, corresponding command prompt information is generated based on the above task command, and the command prompt information is input into the large language model to obtain the behavior description information of the task command.

[0018] The command prompt information may be a prompt information Prompt applied to a large language model and generated based on a command task. A large language model (LLM) may be a natural language processing model composed of hundreds of millions of parameters, based on a deep learning algorithm, and pre-trained using large-scale corpus to perform text understanding, generation, and conversion. Large language models may include GPT-3, ERNIE Bot, etc., which may be set according to actual conditions.

[0019] In implementation, the model architecture of the large language model can be constructed according to actual conditions, and the large language model can be pre-trained using specified data. Then, the pre-trained large language model can be fine-tuned using the prompt information corresponding to the specified task command and the corresponding label information (i.e., the behavior description information corresponding to the specified task command) to obtain the final large language model. At this time, the large language model can generate the behavior description information corresponding to the specified task command based on the prompt information corresponding to the specified task command. Specifically, the construction rules of the prompt information can be set in advance, and the construction rules can include multiple types. For example, a semantic analysis is performed on the task command to obtain the semantic information of the task command, and then prompt information with the same semantics as the semantic information can be generated, or an intent analysis is performed on the task command to obtain the intent information of the task command, and then prompt information with the same intent as the intent information can be generated, etc. The specific setting can be based on actual conditions. Figure 2 As shown, after obtaining the task command in the above manner, the task command can be converted into the corresponding prompt information Prompt (i.e., command prompt information) using the above construction rules. Afterwards, the command prompt information can be input into the fine-tuned large language model, and the behavior description information of the task command can be generated by the large language model. For example, if the task command is the task command in the above example, the above specific task command can be converted into command prompt information, such as "Very briefly describe what adversaries attempt to do by the following shell statement: Statement:'C:\Windows\System32\rundll32.exe C:\windows\System32\ comsvcs .dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full'", and then the above command prompt information can be input into the large language model to output the behavior description information of the task command, such as "Adversaries attempt to access credential materialstored in the process memory of the Local Security Authority SubsystemService (LSASS)", etc., which can also be set according to actual conditions.

[0020] In step S106, the behavior description information of the task command is input into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command.

[0021] Among them, the encoder can be constructed by a variety of different algorithms or models. For example, the encoder can be constructed by a One-Hot Encoding algorithm, or the encoder can be constructed by a word frequency-inverse document frequency algorithm, or the encoder can be constructed by a word-vector (Word2vec) model, or the encoder can be constructed by a preset feature extraction algorithm, etc. The specific settings can be based on actual conditions, and the embodiments of this specification do not limit this.

[0022] In implementation, considering that the behavior description information of the task command output by the above-mentioned large language model is usually text information, it is difficult to use the text information directly for subsequent processing. Therefore, it is necessary to convert the above-mentioned text information into data that can be recognized by the computer (such as matrix or vector, etc.). Based on this, an encoder can be constructed. The architecture of the encoder can be constructed through a variety of different algorithms or models. Then, the corresponding training samples can be obtained, and the encoder can be trained using the training samples to obtain a trained encoder. The trained encoder can convert text information into data that can be recognized by the computer. Figure 2 As shown, the behavior description information of the above task command can be input into the above trained encoder (i.e. Figure 2 In the B2V (BD2Vec) in the task command, the encoder extracts valid words in the behavior description information of the task command (such as the words remaining after removing repeated words, stop words, etc.), and the extracted valid words can be converted into corresponding matrices or vectors, so as to obtain the encoding information corresponding to the behavior description information of the task command.

[0023] In step S108, based on the similarity between the coding information corresponding to the behavior description information of the above-mentioned task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the above-mentioned task command is a command with a preset attack risk, and an instruction on whether to continue executing the task command is output based on the judgment result.

[0024] Among them, the technical and tactical knowledge base can be a pre-built database, an open source database, a database set up by expert experience according to actual conditions, or a database built based on a large amount of historical data, etc., which can be set specifically according to actual conditions. The technical and tactical knowledge base can include relevant information about tactics and relevant information about technology. Tactics can be the ultimate purpose behind the task command, that is, why these task commands are executed. In the context of attack, tactics describe the attacker's high-level goals or motivations, such as obtaining remote access to the system or data leakage, etc., and technology can be the specific actions of the task command execution, that is, how the task command is executed step by step. In the context of network security, technology usually refers to the specific method or process used by the attacker to achieve its goal. For example, using Unix shell scripts to execute malicious code is a technology, etc. The relevant information about tactics can include multiple types, such as the identification, category, description information, etc. of tactics, which can be set specifically according to actual conditions. The relevant information about technology can include multiple types, such as the identification, category, description information, etc. of the technology, which can be set specifically according to actual conditions. In addition, a tactic can include one or more different technologies, and a technology can belong to different tactics respectively. It should be noted that, in order to distinguish from other tactics and techniques, the tactics in the technical and tactical knowledge base can be called baseline attack tactics, and the techniques in the technical and tactical knowledge base can be called baseline attack techniques. Accordingly, a baseline attack tactic can include one or more different baseline attack techniques, and a baseline attack technique can belong to different baseline attack tactics.

[0025] In implementation, the technical and tactical knowledge base may include the coding information corresponding to each benchmark attack technical description information, or it may be predetermined according to actual conditions that the technical and tactical knowledge base may include the coding information corresponding to each benchmark attack technical description information, etc., which may be specifically set according to actual conditions. Figure 2 As shown, the coding information corresponding to the behavior description information of the above task command and each benchmark attack technology description information in the technical and tactical knowledge base (such as Figure 2 The similarity between the coded information corresponding to the behavior description information of the task command and the coded information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base can be calculated to obtain a corresponding similarity value (which can be recorded as a second similarity value). If the multiple first similarity values ​​include a first similarity value greater than the first preset threshold value (such as including Figure 2), it can be determined that the task command is a command with a preset attack risk; otherwise, it can be determined that the task command is not a command with a preset attack risk, or if the plurality of second similarity values ​​include a second similarity value greater than a second preset threshold value (such as including Figure 2 ), it can be determined that the above-mentioned task command is a command with a preset attack risk; otherwise, it can be determined that the above-mentioned task command is not a command with a preset attack risk; or, if multiple first similarity values ​​include a first similarity value greater than a first preset threshold value, and multiple second similarity values ​​include a second similarity value greater than a second preset threshold value, it can be determined that the above-mentioned task command is a command with a preset attack risk; otherwise, it can be determined that the above-mentioned task command is not a command with a preset attack risk. If it is determined that the above-mentioned task command is a command with a preset attack risk, the execution of the task command can be stopped; if it is determined that the above-mentioned task command is not a command with a preset attack risk, the execution of the task command can be continued.

[0026] The embodiment of the present specification provides a method for processing a task command, by intercepting a task command to be executed, generating corresponding command prompt information based on the task command, and inputting the command prompt information into a large language model to obtain behavior description information of the task command, inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command, and judging based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in a technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base. Whether the task command is a command with a preset attack risk, and based on the judgment result, an instruction on whether to continue to execute the task command is output. In this way, the large language model's powerful understanding ability of the task command is used to generate corresponding behavior description information, and identification is performed directly from the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier, reducing resource consumption and improving the detection efficiency of malicious task commands. Moreover, if the category needs to be expanded, it only needs to add the baseline attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, without the need to retrain the model, thereby further reducing resource consumption and improving the detection efficiency of malicious task commands.

[0027] In actual applications, there may be various specific processing methods for generating corresponding command prompt information based on the above-mentioned task command in the above-mentioned step S104. An optional processing method is provided below, which may specifically include the following contents: inputting the above-mentioned task command into a command description prompt template to generate corresponding command prompt information, and the command description prompt template includes sub-prompt information for indicating the requirements that the behavior description information output by the large language model needs to meet.

[0028] Among them, the command description prompt template may include multiple types, and the command description prompt template may include sub-prompt information to be completed and sub-prompt information used to indicate the requirements that the behavior description information output by the large language model needs to meet, etc. The sub-prompt information used to indicate the requirements that the behavior description information output by the large language model needs to meet may include multiple types. For example, the sub-prompt information for indicating the requirements that the behavior description information output by the large language model needs to meet may be sub-prompt information that conforms to the description style or description method of each benchmark attack technology description information in the technical and tactical knowledge base. Specifically, the command description prompt template may be “Very briefly describe what adversaries attempt to do by the following shell statement: Statement: <command> ; xxxxx (sub-prompt information used to indicate the requirements that the behavior description information output by the large language model must meet)", where "command" represents the specific content of the task command, which can also be set according to actual conditions.

[0029] In implementation, the above task command can be input into the command description prompt template, and the task command can be used to supplement or replace the specified position or specified content (such as the content of the above "command" part) in the command description prompt template, so as to generate corresponding command prompt information. For example, the task command is "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id$env:TEMP\lsass-comsvcs.dmp full", and the above task command can be input into the above command description prompt template to obtain "Very briefly describe what adversaries attempt to do by the following shell statement: Statement: <C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full> ; xxxxx (a sub-prompt information indicating the requirements that the behavior description information output by the large language model must meet)". After that, the above command prompt information can be input into the large language model, and the large language model analyzes "Very briefly describe what adversaries attempt to do by the following shell statement: Statement: <C:\Windows\System32\rundll32.exe C:\windows\System32 \comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full> " and other contents. At the same time, it can be combined with "sub-prompt information used to indicate the requirements that the behavior description information output by the large language model needs to meet" to finally generate the behavior description information of the task command.

[0030] In practical applications, the sub-prompt information for indicating the requirements that the behavior description information output by the large language model needs to meet includes a task command example and a behavior description information example corresponding to the task command example.

[0031] In implementation, specifically, the command description prompt template may be: Very briefly describe what adversaries attempt to do by the following shell statement: Statement: <command> Example (follow the style of the following DESCRIPTION): Statement: `C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full` DESCRIPTION: Adversaries attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service(LSASS). The content after "Example" is an example, where "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id$env:TEMP\lsass-comsvcs.dmp full" is a task command example, and "Adversaries attempt toaccess credential material stored in the process memory of the Local SecurityAuthority Subsystem Service (LSASS)" is an example of behavior description information corresponding to the above task command example. In actual applications, the content after "Example" can be replaced with other content, or specified content can be added on the basis of the above content. The specific setting can be based on actual conditions, and this specification embodiment does not limit this.

[0032] In practical applications, in the above step S108, based on the similarity between the coding information corresponding to the behavior description information of the above task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, there are various specific processing methods for determining whether the task command is a command with a preset attack risk. An optional processing method is provided below, such as Figure 3 As shown, the processing may specifically include the following steps S1082 to S1088.

[0033] In step S1082, each benchmark attack technology description information in the technology and tactics knowledge base is input into the encoder respectively to obtain the encoding information corresponding to each benchmark attack technology description information.

[0034] The encoder may be an encoder built based on BD2Vec (Behavior Description to Vector). The above encoding information may be a vector in a feature space.

[0035] In the implementation, each benchmark attack technology description information in the technical and tactical knowledge base is input into the encoder built based on BD2Vec, so as to encode each benchmark attack technology description information into a vector in the feature space based on the encoder. ,in, Indicates i Description of the benchmark attack techniques.

[0036] In step S1084, based on the similarity between the coding information corresponding to the behavior description information of the above-mentioned task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, the benchmark attack technology information corresponding to the task command is determined.

[0037] In implementation, the coding information corresponding to the behavior description information of the above task command can be The coded information corresponding to each benchmark attack technique description information in the technical and tactical knowledge base Substituting into the following formula,

[0038] Get the benchmark attack technology information corresponding to the task command ,in, Indicates the encoding information corresponding to the behavior description information of the above task command The coded information corresponding to each benchmark attack technique description information in the technical and tactical knowledge base The similarity between .

[0039] In step S1086, based on the similarity between the coding information corresponding to the behavior description information of the above-mentioned task command and the coding information corresponding to the benchmark attack technical description information contained in each benchmark attack tactic in the technical and tactical knowledge base, the benchmark attack tactic information corresponding to the task command is determined.

[0040] In order to identify the benchmark attack tactical information corresponding to the above mission command, For each baseline attack tactic in the technical and tactical knowledge base, which may include one or more baseline attack technologies, the similarity between the coding information corresponding to the behavior description information of the above-mentioned task command and the coding information corresponding to the baseline attack technology description information contained in each baseline attack tactic in the technical and tactical knowledge base can be calculated based on the same processing method as above. For a certain baseline attack tactic, the coding information corresponding to the baseline attack technology description information with a similarity greater than a preset threshold can be obtained, or the coding information corresponding to the baseline attack technology description information with the greatest similarity can be obtained. Based on the coding information corresponding to the baseline attack technology description information obtained above, the baseline attack tactic information corresponding to the task command can be determined.

[0041] In step S1088, based on the baseline attack technical information corresponding to the task command and / or the baseline attack tactical information corresponding to the task command, it is determined whether the task command is a command with a preset attack risk.

[0042] In implementation, if the benchmark attack technical information corresponding to the task command exists, it can be determined that the above task command is a command with a preset attack risk, otherwise, it can be determined that the above task command is not a command with a preset attack risk, or, if the benchmark attack tactical information corresponding to the task command exists, it can be determined that the above task command is a command with a preset attack risk, otherwise, it can be determined that the above task command is not a command with a preset attack risk, or, if the benchmark attack technical information corresponding to the task command exists and the benchmark attack tactical information corresponding to the task command exists, it can be determined that the above task command is a command with a preset attack risk, otherwise, it can be determined that the above task command is not a command with a preset attack risk.

[0043] In practical applications, the specific processing methods of the above step S1086 can be varied. An optional processing method is provided below, such as Figure 4 As shown, the processing may specifically include the following steps S10862 to S10866.

[0044] In step S10862, the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technology and tactics knowledge base is determined.

[0045] In step S10864, ​​for each benchmark attack tactic, a similarity greater than a preset similarity threshold is obtained, and an average value of the obtained similarities is calculated.

[0046] In step S10866, based on the average value corresponding to each benchmark attack tactic, the benchmark attack tactic information corresponding to the task command is determined.

[0047] In implementation, the coding information corresponding to the behavior description information of the above-mentioned task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base can be substituted into the following formula:

[0048] Get the benchmark attack tactical information corresponding to the above mission command .in, Represents the average function, used to calculate the average value, k Indicates the number of similarities greater than a preset similarity threshold (in this embodiment, the similarity values ​​are sorted from large to small, and the ones ranked first are selected k The similarity of ).

[0049] In practical applications, the encoder can be trained in the following manner, and details can be found in the processing of steps A2 to A10 below.

[0050] In step A2, a training sample constructed for a preset task command sample is obtained, wherein the training sample includes a behavior description sample corresponding to the preset task command sample and benchmark attack technology description information in a technical and tactical knowledge base.

[0051] Among them, the training samples may include positive samples and / or negative samples. The positive samples may be composed of the behavior description samples corresponding to the preset task command samples and the benchmark attack technology description information corresponding to the preset task command samples. The negative samples may be composed of the behavior description samples corresponding to the preset task command samples and other benchmark attack technology description information (i.e., the benchmark attack technology description information in the technical and tactical knowledge base except the benchmark attack technology description information corresponding to the preset task command samples), etc., which can be specifically set according to actual conditions.

[0052] In step A4, the behavior description samples in the training samples are input into the encoder to obtain the behavior sample encoding information corresponding to the behavior description samples.

[0053] In step A6, the benchmark attack technology description information in the training sample is input into the encoder to obtain the encoding information corresponding to the benchmark attack technology description information in the training sample.

[0054] In step A8, based on the behavior sample encoding information and the encoding information corresponding to the benchmark attack technique description information in the training sample, corresponding loss information is determined through a preset contrast learning loss function.

[0055] Among them, the contrastive learning loss function can be a cross entropy loss function, or the contrastive learning loss function can be an InfoNCE Loss loss function, etc., which can be set according to actual conditions, and the embodiments of this specification do not limit this.

[0056] In step A10, the parameters of the encoder are adjusted based on the loss information to train the encoder until the contrastive learning loss function converges, thereby obtaining a trained encoder.

[0057] In practical applications, the specific processing methods of the above step A2 can be varied. An optional processing method is provided below, such as Figure 5 As shown, the processing may specifically include the following steps A202 to A210.

[0058] In step A202, a preset task command sample and a benchmark attack technology category corresponding to the preset task command sample are obtained.

[0059] Among them, the preset task command sample is as follows Figure 5 As shown in the figure, that is, "wmic shadowcopy call ceate Volume=C:\\", the benchmark attack technology category corresponding to the preset task command sample is T1003.001, and the benchmark attack technology description information corresponding to the preset task command sample is as follows Figure 5 The content of the "Description" part in the example. The benchmark attack technology category can be used as the label information of the preset task command sample. The benchmark attack technology category can be the identifier of the benchmark attack technology, such as the ID or code of the benchmark attack technology. The benchmark attack technology category can be the name of the benchmark attack technology, etc. It can be set according to actual conditions, and this specification embodiment does not limit this.

[0060] In step A204, corresponding command sample prompt information is generated based on the preset task command sample, and the command sample prompt information is input into the large language model to obtain a behavior description sample corresponding to the preset task command sample.

[0061] In step A206, based on the benchmark attack technology category, the benchmark attack technology description information corresponding to the preset task command sample is obtained from the technical and tactical knowledge base.

[0062] In step A208, a positive sample in the training sample is constructed based on the behavior description sample corresponding to the preset task command sample and the benchmark attack technology description information corresponding to the preset task command sample.

[0063] In step A210, negative samples in the training samples are constructed based on the behavior description samples corresponding to the preset task command samples and the benchmark attack technology description information in the technical and tactical knowledge base except the benchmark attack technology description information corresponding to the preset task command samples.

[0064] Based on the above processing of steps A202 to A210 and steps A4 to A10, see Figure 6 shown.

[0065] In practical applications, the technical and tactical knowledge base can include the ATT&CK knowledge base, which is the MITRE Advanced Tactics Techniques and Common Knowledge, that is, the intruder tactics, techniques and common knowledge base. It is a guide for classifying and explaining network attack intrusions from the perspective of hackers, created by MITRE. The ATT&CK knowledge base is a knowledge base of adversarial techniques based on real-world observations. The ATT&CK knowledge base focuses on how attackers interact with systems during operations, reflecting the various stages of the attacker's attack life cycle and the various techniques used on different platforms. The ATT&CK knowledge base is largely a knowledge base of adversarial techniques. Adversarial techniques are a subdivision and classification of offensive operations that can be used on specific platforms (such as Windows, etc.). Unlike previous work in this field, the focus is not on the tools and malware used by the adversary, but on how they interact with the system during operations. The MITRE ATT&CK knowledge base classifies multiple techniques and provides a globally accessible knowledge base for analyzing malicious commands based on real-world observations. The MITRE ATT&CK knowledge base defines more than ten baseline attack tactics and approximately 200 baseline attack techniques, which support the analysis of malicious commands and the development of countermeasures.

[0066] Task commands are commands composed of characters or instructions that execute preset operations in a preset operating system. Task commands usually consist of executable programs (exeutables), options (options) and parameters (parameters). Task commands can be benign and used for normal system operations, or malicious and used to perform attacks or unauthorized activities.

[0067] The embodiment of the present specification provides a method for processing a task command, by intercepting a task command to be executed, generating corresponding command prompt information based on the task command, and inputting the command prompt information into a large language model to obtain behavior description information of the task command, inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command, and judging based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in a technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base. Whether the task command is a command with a preset attack risk, and based on the judgment result, an instruction on whether to continue to execute the task command is output. In this way, the large language model's powerful understanding ability of the task command is used to generate corresponding behavior description information, and identification is performed directly from the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier, reducing resource consumption and improving the detection efficiency of malicious task commands. Moreover, if the category needs to be expanded, it only needs to add the baseline attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, without the need to retrain the model, thereby further reducing resource consumption and improving the detection efficiency of malicious task commands.

[0068] The above is a method for processing a task command provided in an embodiment of this specification. Based on the same idea, an embodiment of this specification also provides a device for processing a task command, such as Figure 7 shown.

[0069] The task command processing device includes: a command interception module 701, a behavior description determination module 702, a first encoding module 703 and a task command detection module 704, wherein: A command interception module 701 intercepts task commands to be executed; The behavior description determination module 702 generates corresponding command prompt information based on the task command, and inputs the command prompt information into the large language model to obtain the behavior description information of the task command; The first encoding module 703 inputs the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; The task command detection module 704 determines whether the task command is a command with a preset attack risk based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, and outputs an instruction on whether to continue executing the task command based on the judgment result.

[0070] In an embodiment of the present specification, the behavior description determination module 702 inputs the task command into a command description prompt template to generate corresponding command prompt information, wherein the command description prompt template includes sub-prompt information for indicating requirements that the behavior description information output by the large language model must meet.

[0071] In the embodiment of the present specification, the sub-prompt information includes a task command example and a behavior description information example corresponding to the task command example.

[0072] In the embodiment of this specification, the task command detection module 704 includes: A first encoding unit, inputting each benchmark attack technology description information in the technology and tactics knowledge base into the encoder respectively, to obtain encoding information corresponding to each benchmark attack technology description information; A technology determination unit determines the baseline attack technology information corresponding to the task command based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each baseline attack technology description information in the technology and tactics knowledge base; a tactic determination unit, which determines the baseline attack tactic information corresponding to the task command based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the baseline attack technology description information contained in each baseline attack tactic in the technical and tactical knowledge base; The task command detection unit determines whether the task command is a command with a preset attack risk based on the benchmark attack technical information corresponding to the task command and / or the benchmark attack tactical information corresponding to the task command.

[0073] In an embodiment of the present specification, the tactical determination unit determines the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technical description information contained in each benchmark attack tactic in the technical and tactical knowledge base; for each benchmark attack tactic, obtains a similarity greater than a preset similarity threshold, and calculates an average value of the obtained similarities; based on the average value corresponding to each benchmark attack tactic, determines the benchmark attack tactic information corresponding to the task command.

[0074] In the embodiment of this specification, the device further includes: A training sample acquisition module is used to acquire a training sample constructed for a preset task command sample, wherein the training sample includes a behavior description sample corresponding to the preset task command sample and a reference attack technology description information in the technical and tactical knowledge base; A second encoding module, inputting the behavior description sample in the training sample into the encoder to obtain the behavior sample encoding information corresponding to the behavior description sample; A third encoding module, inputting the benchmark attack technology description information in the training sample into the encoder to obtain encoding information corresponding to the benchmark attack technology description information in the training sample; A loss determination module, based on the coding information of the behavior sample and the coding information corresponding to the benchmark attack technology description information in the training sample, determines corresponding loss information through a preset contrast learning loss function; A training module adjusts parameters of the encoder based on the loss information to train the encoder until the contrastive learning loss function converges, thereby obtaining a trained encoder.

[0075] In the embodiment of this specification, the training sample acquisition module includes: A sample acquisition unit, which acquires a preset task command sample and a benchmark attack technology category corresponding to the preset task command sample; A sample behavior determination unit generates corresponding command sample prompt information based on the preset task command sample, and inputs the command sample prompt information into the large language model to obtain a behavior description sample corresponding to the preset task command sample; A sample tactics determination unit, based on the benchmark attack technology category, obtains the benchmark attack technology description information corresponding to the preset task command sample from the technology and tactics knowledge base; A positive sample determination unit, which constructs a positive sample in the training sample based on the behavior description sample corresponding to the preset task command sample and the benchmark attack technology description information corresponding to the preset task command sample; The negative sample determination unit constructs negative samples in the training samples based on the behavior description samples corresponding to the preset task command samples and the benchmark attack technology description information in the technical and tactical knowledge base except the benchmark attack technology description information corresponding to the preset task command samples.

[0076] In the embodiment of this specification, the technical and tactical knowledge base includes the ATT&CK knowledge base, and the task command is a command composed of characters or instructions for performing preset operations in a preset operating system.

[0077] The embodiment of the present specification provides a task command processing device, which intercepts the task command to be executed, generates corresponding command prompt information based on the task command, and inputs the command prompt information into a large language model to obtain behavior description information of the task command, inputs the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command, and judges based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base. Whether the task command is a command with a preset attack risk, and based on the judgment result, an instruction on whether to continue to execute the task command is output. In this way, the large language model's powerful understanding ability of the task command is used to generate corresponding behavior description information, and identification is performed directly from the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier, reducing resource consumption and improving the detection efficiency of malicious task commands. Moreover, if the category needs to be expanded, it only needs to add the baseline attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, without the need to retrain the model, thereby further reducing resource consumption and improving the detection efficiency of malicious task commands.

[0078] The above is a task command processing device provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a task command processing device, such as Figure 8 shown.

[0079] The task command processing device may be a terminal device or a server, etc. provided in the above-mentioned embodiment.

[0080] The processing device of the task command may have relatively large differences due to different configurations or performances, and may include one or more processors 801 and memory 802, and the memory 802 may store one or more storage applications or data. Among them, the memory 802 may be a short-term storage or a persistent storage. The application stored in the memory 802 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the processing device of the task command. Furthermore, the processor 801 may be configured to communicate with the memory 802, and execute a series of computer executable instructions in the memory 802 on the processing device of the task command. The processing device of the task command may also include one or more power supplies 803, one or more wired or wireless network interfaces 804, one or more input and output interfaces 805, and one or more keyboards 806.

[0081] Specifically in this embodiment, the task command processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the task command processing device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following: Intercept the task commands to be executed; Based on the task command, corresponding command prompt information is generated, and the command prompt information is input into a large language model to obtain behavior description information of the task command; Inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; Based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the task command is a command with a preset attack risk, and an instruction on whether to continue executing the task command is output based on the judgment result.

[0082] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the task command processing device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0083] The embodiment of the present specification provides a task command processing device, which intercepts the task command to be executed, generates corresponding command prompt information based on the task command, and inputs the command prompt information into a large language model to obtain behavior description information of the task command, inputs the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command, and judges based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in a technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base. Whether the task command is a command with a preset attack risk, and based on the judgment result, an instruction on whether to continue to execute the task command is output. In this way, the large language model's powerful understanding ability of the task command is used to generate corresponding behavior description information, and identification is performed directly from the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier, reducing resource consumption and improving the detection efficiency of malicious task commands. Moreover, if the category needs to be expanded, it only needs to add the baseline attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, without the need to retrain the model, thereby further reducing resource consumption and improving the detection efficiency of malicious task commands.

[0084] Furthermore, based on the above Figures 1 to 6 In one embodiment, the present specification further provides a storage medium for storing computer executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instruction information stored in the storage medium is executed by the processor, the following process can be implemented: Intercept the task commands to be executed; Based on the task command, corresponding command prompt information is generated, and the command prompt information is input into a large language model to obtain behavior description information of the task command; Inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; Based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the task command is a command with a preset attack risk, and an instruction on whether to continue executing the task command is output based on the judgment result.

[0085] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0086] The embodiment of the present specification provides a storage medium, which intercepts a task command to be executed, generates corresponding command prompt information based on the task command, and inputs the command prompt information into a large language model to obtain behavior description information of the task command, inputs the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command, and judges the task command based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base. Whether the command is a command with a preset attack risk, and output an instruction on whether to continue executing the task command based on the judgment result. In this way, the large language model's powerful understanding ability of the task command is used to generate corresponding behavior description information, and identification is directly carried out based on the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier, reducing resource consumption and improving the detection efficiency of malicious task commands. Moreover, if the category needs to be expanded, it only needs to add the benchmark attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, without the need to retrain the model, thereby further reducing resource consumption and improving the detection efficiency of malicious task commands.

[0087] Furthermore, based on the above Figures 1 to 6 In one or more embodiments of the present specification, a computer program product is provided, including a computer program. When the computer program in the computer program product is executed by a processor, the following process can be implemented: Intercept the task commands to be executed; Based on the task command, corresponding command prompt information is generated, and the command prompt information is input into a large language model to obtain behavior description information of the task command; Inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; Based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the task command is a command with a preset attack risk, and an instruction on whether to continue executing the task command is output based on the judgment result.

[0088] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned computer program product embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0089] The embodiment of the present specification provides a computer program product, which intercepts a task command to be executed, generates corresponding command prompt information based on the task command, and inputs the command prompt information into a large language model to obtain behavior description information of the task command, inputs the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command, and judges the task command based on the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the encoding information corresponding to the behavior description information of the task command and the encoding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base. Whether the task command is a command with a preset attack risk, and output an instruction on whether to continue to execute the task command based on the judgment result. In this way, the large language model's powerful understanding ability of the task command is used to generate the corresponding behavior description information, and identification is directly based on the behavior description information of the task command. Therefore, it does not rely on the classifier to perform semantic analysis on the task command, and thus does not require a large amount of labeled data for training the classifier, reducing resource consumption and improving the detection efficiency of malicious task commands. Moreover, if the category needs to be expanded, it only needs to add the benchmark attack technology description information and construct the corresponding encoding information (such as feature vectors, etc.) in the technical and tactical knowledge base, without the need to retrain the model, thereby further reducing resource consumption and improving the detection efficiency of malicious task commands.

[0090] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0091] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0092] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0093] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0094] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0095] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0096] The embodiments of this specification are described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable fraud case serial and parallel device to produce a machine, so that the instructions executed by the processor of the computer or other programmable fraud case serial and parallel device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable fraud case serial and parallel device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0101] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0102] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0103] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0104] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0105] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0106] The above description is only an embodiment of this specification and is not intended to limit this document. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this specification.

Claims

1. A method for processing a task command, the method comprising: Intercept the task commands to be executed; Based on the task command, corresponding command prompt information is generated, and the command prompt information is input into a large language model to obtain behavior description information of the task command; Inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; Based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the task command is a command with a preset attack risk, and an instruction on whether to continue executing the task command is output based on the judgment result.

2. The method according to claim 1, wherein generating corresponding command prompt information based on the task command comprises: The task command is input into a command description prompt template to generate corresponding command prompt information, wherein the command description prompt template includes sub-prompt information for indicating requirements that the behavior description information output by the large language model needs to meet.

3. According to the method of claim 2, the sub-prompt information includes a task command example and a behavior description information example corresponding to the task command example.

4. The method according to claim 1, based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, judging whether the task command is a command with a preset attack risk, comprises: Input each benchmark attack technology description information in the technology and tactics knowledge base into the encoder to obtain encoding information corresponding to each benchmark attack technology description information; Determine the benchmark attack technology information corresponding to the task command based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base; Determine the baseline attack tactic information corresponding to the task command based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the baseline attack technical description information contained in each baseline attack tactic in the technical and tactical knowledge base; Based on the baseline attack technical information corresponding to the task command and / or the baseline attack tactical information corresponding to the task command, it is determined whether the task command is a command with a preset attack risk.

5. The method according to claim 4, wherein the determining the baseline attack tactic information corresponding to the task command based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the baseline attack technology description information contained in each baseline attack tactic in the technical and tactical knowledge base comprises: Determine the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technology and tactics knowledge base; For each benchmark attack tactic, obtain a similarity greater than a preset similarity threshold, and calculate an average value of the obtained similarities; Based on the average value corresponding to each benchmark attack tactic, benchmark attack tactic information corresponding to the task command is determined.

6. The method according to claim 5, further comprising: Acquire a training sample constructed for a preset task command sample, wherein the training sample includes a behavior description sample corresponding to the preset task command sample and benchmark attack technology description information in the technical and tactical knowledge base; Inputting the behavior description samples in the training samples into the encoder to obtain the behavior sample encoding information corresponding to the behavior description samples; Inputting the benchmark attack technology description information in the training sample into the encoder to obtain encoding information corresponding to the benchmark attack technology description information in the training sample; Based on the coding information of the behavior sample and the coding information corresponding to the benchmark attack technology description information in the training sample, determining corresponding loss information through a preset contrast learning loss function; The parameters of the encoder are adjusted based on the loss information to train the encoder until the contrastive learning loss function converges, thereby obtaining a trained encoder.

7. The method according to claim 6, wherein obtaining a training sample constructed for a preset task command sample comprises: Obtaining a preset task command sample and a benchmark attack technology category corresponding to the preset task command sample; Based on the preset task command sample, generate corresponding command sample prompt information, and input the command sample prompt information into the large language model to obtain a behavior description sample corresponding to the preset task command sample; Based on the benchmark attack technology category, obtaining benchmark attack technology description information corresponding to the preset task command sample from the technical and tactical knowledge base; Constructing a positive sample in the training sample based on the behavior description sample corresponding to the preset task command sample and the benchmark attack technology description information corresponding to the preset task command sample; Negative samples in the training samples are constructed based on the behavior description samples corresponding to the preset task command samples and the benchmark attack technology description information in the technical and tactical knowledge base except the benchmark attack technology description information corresponding to the preset task command samples.

8. According to the method described in any one of claims 1 to 7, the technical and tactical knowledge base includes an ATT&CK knowledge base, and the task command is a command consisting of characters or instructions for performing preset operations in a preset operating system.

9. A task command processing device, the device comprising: Command interception module, intercepting task commands to be executed; A behavior description determination module generates corresponding command prompt information based on the task command, and inputs the command prompt information into a large language model to obtain behavior description information of the task command; A first encoding module, inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; The task command detection module determines whether the task command is a command with a preset attack risk based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, and outputs an instruction on whether to continue executing the task command based on the judgment result.

10. A task command processing device, the task command processing device comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Intercept the task commands to be executed; Based on the task command, corresponding command prompt information is generated, and the command prompt information is input into a large language model to obtain behavior description information of the task command; Inputting the behavior description information of the task command into a pre-trained encoder to obtain encoding information corresponding to the behavior description information of the task command; Based on the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to each benchmark attack technology description information in the technical and tactical knowledge base, and / or the similarity between the coding information corresponding to the behavior description information of the task command and the coding information corresponding to the benchmark attack technology description information contained in each benchmark attack tactic in the technical and tactical knowledge base, it is determined whether the task command is a command with a preset attack risk, and an instruction on whether to continue executing the task command is output based on the judgment result.

Images