Method, system and equipment for realizing security protection and early warning of host and storage medium

Abstract

The invention discloses a method, a system and equipment for realizing security protection and early warning of a host, and a storage medium, belongs to the technical field of network security, and solves the technical problem of how to actively, efficiently and accurately execute risk protection measures and predict potential security threats. The method comprises the steps of realizing a hybrid enhancement strategy based on a modular RAG + fine tuning Fine-Tuning technology, retrieving and generating a structured prompt cue word, outputting a standardized instruction set, avoiding invalid information branches, and performing data updating on a safe knowledge base to enhance the quality and accuracy of AI-Agent execution; constructing an AI-Agent host security monitoring model, analyzing data in three aspects of security vulnerabilities, user operations and network activities, and training to obtain a mature risk monitoring model; collecting operation feature data of a target in real time, and performing data analysis and feature point extraction; and carrying out association analysis on the risk characteristics to generate a repair strategy meeting an instruction set triggering condition, and predicting a future risk trend. And multi-dimensional and multi-level host security protection can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method, system, device and storage medium for implementing host security protection and early warning. Background Art

[0002] With the development of the times and technological progress, the development of network security has continued to deepen. In the early days, an important security issue was to limit computer access rights. Weak passwords and simple access control methods were vulnerable to hacker attacks. With the rapid development of the Internet, security defense methods such as encryption technology, virtual private networks (VPNs), and network traffic analysis have emerged, but most network security management focuses on passive defense. Today, network security boundaries have gradually become generalized and blurred, showing characteristics such as easy change, complexity, fuzziness, and uncertainty, which makes data assets face security threats all the time. With the emergence and development of the concept of artificial intelligence, especially the widespread application of deep learning, new solutions have been provided to enhance the accuracy, real-time and flexibility of risk identification, predict and identify potential security threats, and make network security management proactive.

[0003] With the widespread application of artificial intelligence, it has been proven that AI large models have obvious advantages in natural language understanding, complex data analysis, and rapid response. Although AI has many advantages in network security, it also brings new challenges and problems. Facing complex and changing network environments and attacks, how to actively, efficiently and accurately implement risk protection measures and predict potential security threats still faces severe challenges. Summary of the invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art. The first purpose of the present invention is to provide a method for realizing host security protection and early warning, which can timely detect abnormal activities and potential security threats, and actively, efficiently and accurately implement risk protection measures.

[0005] The second purpose of the present invention is to provide a system for realizing host security protection and early warning.

[0006] A third object of the present invention is to provide a computer device.

[0007] A fourth objective of the present invention is to provide a computer storage medium.

[0008] In order to achieve the above-mentioned objective 1, the present invention provides a method for realizing host security protection and early warning, comprising the following steps:

[0009] S1. Build a network security knowledge base based on modular RAG technology, generate structured prompt words according to the network security knowledge base and user task retrieval data, and output a standard instruction set, interact with AI-Agent according to the structured prompt words and standard instruction set, and construct customized security monitoring requirements;

[0010] S2. Build a security protection monitoring model using deep learning technology according to the security monitoring needs. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data; collect data and build a training data set, and train the vulnerability perception model, security protection model, and intrusion detection model according to the training data set to obtain a mature security protection monitoring model;

[0011] S3. Based on the well-trained security protection monitoring model, monitor the target's operating characteristic data in real time, identify and extract risk characteristic data;

[0012] S4. Perform risk association analysis by analyzing security vulnerabilities, user operations and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions;

[0013] S5. Generate a risk trend analysis report based on the identified triggering conditions of the predicted risks and output the corresponding security repair strategy.

[0014] As a further improvement, step S1 specifically includes:

[0015] S11. Building an offline network security knowledge base based on modular RAG technology, the offline network security knowledge base includes knowledge data collection function, structured processing function, and text block segmentation function;

[0016] S12. Embedding the embedding model in the offline network security knowledge base to build a vector database for converting text blocks of the offline network security knowledge base into vector data for easy retrieval operations;

[0017] S13. Generate structured prompt words by querying, reconstructing, sorting and understanding the data in the offline network security knowledge base;

[0018] S14. Finally, the Fine-Tuning technology is used to output the standard instruction set.

[0019] Furthermore, the modular RAG architecture improves performance by enhancing its functional modules, adding a search module for similarity retrieval, and making fine adjustments to the retrieval tool. The modular RAG architecture can add, replace, or adjust the workflow between modules according to specific task requirements.

[0020] Furthermore, step S2 specifically includes:

[0021] S21. Establishing feature engineering of the security protection monitoring model, including data collection, data cleaning, feature extraction, feature selection, and labeling of normal and abnormal data samples, for classifying training sets and test sets for risk identification in three aspects: security vulnerabilities, user operations, and network activity risk data;

[0022] S22. Based on the algorithm long short-term memory network LSTM and deep Q network DQN, the vulnerability perception model, behavioral security protection model, and intrusion detection model are constructed, and through continuous training, optimization, and adjustment, the vulnerability perception model, behavioral security protection model, and intrusion detection model have the best fitting and generalization capabilities;

[0023] S23. Verify, evaluate and integrate the security protection monitoring model, including classification model evaluation and regression model evaluation.

[0024] Furthermore, the feature engineering includes an input layer, a feature extraction layer, and a neural network layer;

[0025] The input layer is a module for receiving the operation characteristic data of the monitoring target;

[0026] The feature extraction layer is a module for interpreting the instruction set and extracting instruction set features from the data of the input layer;

[0027] The neural network layer is used for deep learning and pattern recognition of the extracted features. The neural network layer includes multiple hidden layers, which are used for nonlinear transformation and feature extraction of input data, thereby learning high-level representations and abstract features of the data to better complete various complex tasks.

[0028] Furthermore, step S4 specifically includes:

[0029] S41. Serialize the activity data of security vulnerabilities, user operations and network activity risk data, and convert them into standardized structure data corresponding to the security protection monitoring model;

[0030] S42. Classify the standardized structure data according to the monitoring indicators to obtain multiple data item sets, each data item set is a set of time-series security transaction data sets for the monitoring indicator;

[0031] S43. Perform frequent item set mining on the time series security transaction data set based on the association analysis FP-growth algorithm, and output the risk item set that is higher than the preset threshold of the standard instruction set;

[0032] S44. Generate association rules based on risk item sets, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks.

[0033] Furthermore, the process of risk association analysis includes association rule mining, association rule evaluation, result interpretation and application; association rule mining is to mine the data set using the association analysis FP-growth algorithm to discover the association rules and patterns between different variables; association rule evaluation is to evaluate and screen the association rules obtained by mining, usually considering support and confidence indicators to determine the reliability and importance of the rules; result interpretation and application is to interpret and analyze the association rules obtained by mining to discover hidden risk information and trends in the data.

[0034] In order to achieve the above-mentioned second objective, the present invention provides a system for realizing host security protection and early warning, comprising:

[0035] The knowledge base module is used to build a network security knowledge base based on modular RAG technology, generate structured prompt words according to the network security knowledge base and user task retrieval data, and output a standard instruction set, interact with the AI-Agent according to the structured prompt words and standard instruction set, and construct customized security monitoring requirements;

[0036] A monitoring model module is used to build a security protection monitoring model using deep learning technology according to the security monitoring requirements. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data; collect data and build a training data set, and train the vulnerability perception model, security protection model, and intrusion detection model according to the training data set to obtain a mature security protection monitoring model;

[0037] The monitoring module is used to monitor the target's operating characteristic data in real time, identify and extract risk characteristic data based on a mature security protection monitoring model;

[0038] An association analysis module is used to perform risk association analysis by analyzing security vulnerabilities, user operations and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions;

[0039] The risk trend analysis module is used to generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output corresponding security repair strategies.

[0040] In order to achieve the third objective above, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned method for realizing host security protection and early warning when executing the computer program.

[0041] In order to achieve the above-mentioned fourth objective, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the above-mentioned method for realizing host security protection and early warning is implemented.

[0042] Beneficial Effects

[0043] Compared with the prior art, the present invention has the following advantages:

[0044] The present invention uses modular RAG+fine-tuning technology to retrieve and generate standard instructions to meet complex and changeable risk monitoring needs, and uses deep learning technology to build a professional risk monitoring model to monitor security vulnerabilities, user operations and network activities in real time, and promptly discover abnormal activities and potential security threats; automatically respond to common network attacks and threats, reduce the need for manual intervention, and improve response speed and efficiency; continuously learn and adapt to new threats and attack methods through machine learning and deep learning technology, and improve the accuracy and credibility of security incidents; predict risk trends and potential security threats, and continuously optimize security strategies to provide personalized security recommendations, which are of great significance in dealing with the increasingly complex Internet environment and security threats in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flow chart of the present invention;

[0046] Figure 2 This is a flow chart of the hybrid strategy of RAG+Fine-Tuning in the present invention. DETAILED DESCRIPTION

[0047] The present invention will be further described below with reference to the specific embodiments in the accompanying drawings.

[0048] See also Figure 1-2 , a method for realizing host security protection and early warning, comprising the following steps S1 to S5:

[0049] S1. Build a network security knowledge base based on modular RAG technology, generate structured prompt words according to the network security knowledge base and user task retrieval information, and output a standard instruction set. Interact with AI-Agent based on the structured prompt words and standard instruction set to construct customized security monitoring needs.

[0050] Step S1 specifically includes:

[0051] S11. Build an offline network security knowledge base based on modular RAG technology. The offline network security knowledge base includes knowledge data collection function, structured processing function, and text block segmentation function;

[0052] S12. embedding the embedding model in the offline network security knowledge base to build a vector database for converting text blocks of the offline network security knowledge base into vector data for easy retrieval operation;

[0053] S13. Generate structured prompt words through query reconstruction, sorting and semantic understanding of the data in the offline network security knowledge base;

[0054] S14. Finally, the Fine-Tuning technology is used to output the standard instruction set.

[0055] In this example, the modular RAG architecture improves performance by enhancing its functional modules, such as adding a search module for similarity retrieval and making fine adjustments to the retrieval tool. Modular RAG can add, replace or adjust the workflow between modules according to specific task requirements, thereby achieving higher diversity and flexibility. This design not only allows modular RAG to include two fixed modes, simple RAG and advanced RAG, but also expands multiple modules including search, memory, fusion, routing, prediction and task adaptation to solve various problems. Fine-Tuning technology can be equipped on modular RAG, so that it can have more refined standards on data sets in the field of network security, thereby optimizing the performance of command output and allowing the AI-Agent interacting with it to perform monitoring, early warning and protection more accurately.

[0056] S2. Use deep learning technology to build a security protection monitoring model based on security monitoring needs. The security protection monitoring model package is used to analyze the vulnerability perception model for security vulnerabilities, the behavioral security protection model for analyzing user operations, and the intrusion detection model for analyzing network activity risk data. Collect data and build a training data set. According to the training data set, the vulnerability perception model, security protection model, and intrusion detection model are trained to obtain a mature security protection monitoring model.

[0057] Step S2 specifically includes:

[0058] S21. Establish feature engineering for security protection monitoring models, including data collection, data cleaning, feature extraction, feature selection, and labeling of normal and abnormal data samples, which are used to classify training sets and test sets for risk identification in three aspects: security vulnerabilities, user operations, and network activity risk data;

[0059] S22. Based on the algorithmic long short-term memory network LSTM and deep Q network DQN, vulnerability perception model, behavioral security protection model and intrusion detection model are constructed. Through continuous training, optimization and adjustment, the vulnerability perception model, behavioral security protection model and intrusion detection model have the best fitting and generalization capabilities;

[0060] S23. Verify, evaluate and integrate the security protection monitoring model, including classification model evaluation and regression model evaluation.

[0061] Feature engineering includes input layer, feature extraction layer, and neural network layer. The input layer is a module for receiving the operating feature data of the monitoring target. The feature extraction layer is a module for interpreting the instruction set and extracting the instruction set features from the data in the input layer. The neural network layer is used for deep learning and pattern recognition of the extracted features. The neural network layer includes multiple hidden layers for nonlinear transformation and feature extraction of the input data, thereby learning the high-level representation and abstract features of the data to better complete various complex tasks.

[0062] S3. Based on the well-trained security protection monitoring model, the target’s operational characteristic data is monitored in real time, and risk characteristic data is identified and extracted.

[0063] S4. Perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain the risk item set and predict the trigger conditions of the risk.

[0064] Step S4 specifically includes:

[0065] S41. Serialize the activity data of security vulnerabilities, user operations and network activity risk data, and convert them into standardized structured data corresponding to the security protection monitoring model;

[0066] S42. Classify the standardized structure data according to the monitoring indicators to obtain multiple data item sets, each data item set is a set of time-series security transaction data sets for the monitoring indicator;

[0067] S43. Based on the association analysis FP-growth algorithm, frequent item sets are mined on the time series security transaction data set, and risk item sets higher than the preset threshold of the standard instruction set are output;

[0068] S44. Generate association rules based on risk item sets, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks.

[0069] The process of risk association analysis includes association rule mining, association rule evaluation, result interpretation and application. Association rule mining is to mine the data set using the association analysis FP-growth algorithm to discover the association rules and patterns between different variables. Association rule evaluation is to evaluate and screen the association rules obtained by mining, usually considering support and confidence indicators to determine the reliability and importance of the rules. Result interpretation and application is to interpret and analyze the association rules obtained by mining to discover hidden risk information and trends in the data.

[0070] In this example, FP-growth is an algorithm for efficiently mining frequent item sets and association rules. It adopts a divide-and-conquer strategy to compress the database that provides frequent item sets into a frequent pattern tree (FP-tree), but still retains the item set association information. FP-tree is a compact data structure that consists of a frequent item header table and an item prefix tree. It can efficiently store the information of frequent item sets. Based on the above structure, the entire data mining process can be accelerated. Compared with other association analysis algorithms such as Apriori, the FP-growth algorithm has certain advantages in performance and can mine frequent item sets and association rules faster. Through the association analysis of the FP-growth algorithm, potential risks can be effectively identified, such as excessive system load, frequent network activities, abnormal operation behaviors, etc., which may be the means used by attackers to attack, and then the corresponding risk trigger conditions are generated.

[0071] S5. Generate a risk trend analysis report based on the identified triggering conditions of the predicted risks, and output the corresponding security repair strategy, which adopts the existing mature repair strategy.

[0072] A system for realizing host security protection and early warning, comprising:

[0073] The knowledge base module is used to build a network security knowledge base based on modular RAG technology, generate structured prompt words according to the network security knowledge base and user task retrieval data, and output standard instruction sets. According to the structured prompt words and standard instruction sets, it interacts with AI-Agent and constructs customized security monitoring requirements;

[0074] The monitoring model module is used to build a security protection monitoring model using deep learning technology according to security monitoring needs. The security protection monitoring model package is used to analyze the vulnerability perception model for security vulnerabilities, the behavioral security protection model for analyzing user operations, and the intrusion detection model for analyzing network activity risk data; collect data and build a training data set, and train the vulnerability perception model, security protection model, and intrusion detection model based on the training data set to obtain a mature security protection monitoring model;

[0075] The monitoring module is used to monitor the target's operating characteristic data in real time, identify and extract risk characteristic data based on a mature security protection monitoring model;

[0076] The association analysis module is used to perform risk association analysis by analyzing security vulnerabilities, user operations and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions;

[0077] The risk trend analysis module is used to generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output corresponding security repair strategies.

[0078] A computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the method for realizing host security protection and early warning is implemented.

[0079] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned method for realizing host security protection and early warning.

[0080] The present invention learns and adapts to the increasingly complex risk monitoring needs through modular RAG+fine-tuning technology, outputs standardized responsive instructions, and interacts with AI-Agent to extract, analyze and predict the operating characteristic data of the monitoring target, thereby achieving data security protection and early warning of the monitoring target to cope with the increasingly complex and changeable network security threats.

[0081] The above are only preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the structure of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent.

Claims

1. A method for realizing host security protection and early warning, It is characterized in that The following steps are involved: S1. Build a network security knowledge base based on modular RAG technology, generate structured prompt words according to the network security knowledge base and user task retrieval data, and output a standard instruction set, interact with AI-Agent according to the structured prompt words and standard instruction set, and construct customized security monitoring requirements; S2. Build a security protection monitoring model using deep learning technology according to the security monitoring needs. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data; collect data and build a training data set, and train the vulnerability perception model, security protection model, and intrusion detection model according to the training data set to obtain a mature security protection monitoring model; S3. Based on the well-trained security protection monitoring model, monitor the target's operating characteristic data in real time, identify and extract risk characteristic data; S4. Perform risk association analysis by analyzing security vulnerabilities, user operations and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions; S5. Generate a risk trend analysis report based on the identified triggering conditions of the predicted risks and output the corresponding security repair strategy.

2. The method for realizing host security protection and early warning according to claim 1, It is characterized in that Step S1 specifically includes: S11. Building an offline network security knowledge base based on modular RAG technology, the offline network security knowledge base includes knowledge data collection function, structured processing function, and text block segmentation function; S12. Embedding the embedding model in the offline network security knowledge base to build a vector database for converting text blocks of the offline network security knowledge base into vector data for easy retrieval operations; S13. Generate structured prompt words by querying, reconstructing, sorting and understanding the data in the offline network security knowledge base; S14. Finally, the Fine-Tuning technology is used to output the standard instruction set.

3. The method for realizing host security protection and early warning according to claim 2, It is characterized in that The modular RAG architecture improves performance by enhancing its functional modules, adding a search module for similarity retrieval, and making fine adjustments to the retrieval tool. The modular RAG architecture can add, replace, or adjust the workflow between modules according to specific task requirements.

4. The method for realizing host security protection and early warning according to claim 1, It is characterized in that Step S2 specifically includes: S21. Establishing feature engineering of the security protection monitoring model, including data collection, data cleaning, feature extraction, feature selection, and labeling of normal and abnormal data samples, for classifying training sets and test sets for risk identification in three aspects: security vulnerabilities, user operations, and network activity risk data; S22. Based on the algorithm long short-term memory network LSTM and deep Q network DQN, the vulnerability perception model, behavioral security protection model, and intrusion detection model are constructed, and through continuous training, optimization, and adjustment, the vulnerability perception model, behavioral security protection model, and intrusion detection model have the best fitting and generalization capabilities; S23. Verify, evaluate and integrate the security protection monitoring model, including classification model evaluation and regression model evaluation.

5. The method for realizing host security protection and early warning according to claim 4, It is characterized in that The feature engineering includes an input layer, a feature extraction layer, and a neural network layer; The input layer is a module for receiving the operation characteristic data of the monitoring target; The feature extraction layer is a module for interpreting the instruction set and extracting instruction set features from the data of the input layer; The neural network layer is used for deep learning and pattern recognition of the extracted features. The neural network layer includes multiple hidden layers, which are used for nonlinear transformation and feature extraction of input data, thereby learning high-level representations and abstract features of the data to better complete various complex tasks.

6. The method for realizing host security protection and early warning according to claim 1, It is characterized in that Step S4 specifically includes: S41. Serialize the activity data of security vulnerabilities, user operations and network activity risk data, and convert them into standardized structure data corresponding to the security protection monitoring model; S42. Classify the standardized structure data according to the monitoring indicators to obtain multiple data item sets, each data item set is a set of time-series security transaction data sets for the monitoring indicator; S43. Perform frequent item set mining on the time series security transaction data set based on the association analysis FP-growth algorithm, and output the risk item set that is higher than the preset threshold of the standard instruction set; S44. Generate association rules based on risk item sets, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks.

7. The method for realizing host security protection and early warning according to claim 6, It is characterized in that The process of risk association analysis includes association rule mining, association rule evaluation, result interpretation and application; association rule mining is to mine the data set using the association analysis FP-growth algorithm to discover the association rules and patterns between different variables; association rule evaluation is to evaluate and screen the association rules obtained by mining, usually considering support and confidence indicators to determine the reliability and importance of the rules; result interpretation and application is to interpret and analyze the association rules obtained by mining to discover hidden risk information and trends in the data.

8. A system for realizing host security protection and early warning, It is characterized in that include: The knowledge base module is used to build a network security knowledge base based on modular RAG technology, generate structured prompt words according to the network security knowledge base and user task retrieval data, and output a standard instruction set, interact with the AI-Agent according to the structured prompt words and standard instruction set, and construct customized security monitoring requirements; A monitoring model module is used to build a security protection monitoring model using deep learning technology according to the security monitoring requirements. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data; collect data and build a training data set, and train the vulnerability perception model, security protection model, and intrusion detection model according to the training data set to obtain a mature security protection monitoring model; The monitoring module is used to monitor the target's operating characteristic data in real time, identify and extract risk characteristic data based on a mature security protection monitoring model; An association analysis module is used to perform risk association analysis by analyzing security vulnerabilities, user operations and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions; The risk trend analysis module is used to generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output corresponding security repair strategies.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program. It is characterized in that When the processor executes the computer program, a method for realizing host security protection and early warning as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, a method for realizing host security protection and early warning as described in any one of claims 1 to 7 is implemented.

Images