Alarm analysis and disposal method, device and computer equipment based on security big model

Abstract

The present application discloses an alarm analysis and disposal method, device and computer equipment based on a security big model, the method comprising: collecting security alarm events through a collection component deployed on each asset side to obtain alarm information; filling an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and disposal decision tree sample information of the security big model, and the instruction description information is used to guide the security big model to output an alarm information disposal decision tree based on a thinking chain; inputting the alarm analysis prompt word into the security big model to generate an alarm information disposal decision tree corresponding to the alarm information through the security big model based on the identity description information, the instruction description information and the disposal decision tree sample information; responding to and disposing of the alarm information based on the alarm information disposal decision tree to achieve disposal of the security alarm event.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an alarm analysis and disposal method, device and computer equipment based on a large security model. Background Art

[0002] With the rapid development of information technology, the information systems of enterprises and organizations are becoming increasingly complex, and various security threats are also increasing. Traditional security alert processing methods often rely on manual analysis and response, which is not only inefficient but also prone to errors. Especially in the face of large-scale and high-frequency security alert events, manual processing seems to be unable to cope with it.

[0003] In order to improve the efficiency and accuracy of security alert processing, some automated security alert analysis and disposal methods have been proposed and applied in actual scenarios in recent years. However, most of these methods are based on fixed rules and algorithms, lack sufficient flexibility and intelligence, and are difficult to deal with complex and changing security threats. In addition, when processing alarm information, these methods can often only provide simple classification or labeling, but cannot give specific disposal suggestions or decision paths, resulting in the need for manual intervention in subsequent security disposal work.

[0004] In addition, the existing security alarm analysis and handling methods still have the problem of information islands. Due to the differences in the format and content of alarm information between different assets and systems, it is difficult to uniformly manage and analyze this information. This not only increases the difficulty of security operation and maintenance, but also reduces the efficiency and accuracy of security alarm processing. Summary of the invention

[0005] In view of this, the embodiments of the present application provide an alarm analysis and disposal method, device, storage medium and computer equipment based on a big security model, which significantly improves the efficiency and accuracy of security alarm processing by automatically collecting, analyzing and disposing of alarm information, reduces the need for manual intervention, and reduces the risk of human error.

[0006] According to one aspect of the present application, a method for analyzing and handling alarms based on a security big model is provided, the method comprising:

[0007] The security alarm events are collected through the collection components deployed on each asset side to obtain alarm information;

[0008] Filling an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and handling decision tree sample information of the security big model, the instruction description information is used to guide the security big model to output an alarm information handling decision tree based on a thinking chain, and the handling decision tree sample information is used to provide a demonstration example of an alarm information handling decision tree based on a thinking chain for the security big model;

[0009] Inputting the alarm analysis prompt word into the security big model, so as to generate an alarm information handling decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the handling decision tree sample information through the security big model;

[0010] The warning information is responded to and handled based on the warning information handling decision tree to achieve handling of the security warning event.

[0011] Optionally, the alarm information handling decision tree includes multiple handling steps based on the thought chain and a handling method corresponding to each handling step, wherein the handling steps include confirming whether the attack is successful, obtaining detailed attack information, confirming whether the attacking IP is a malicious IP, blocking the malicious IP, and checking and killing the compromised assets, and the handling method includes at least database query and API interface call;

[0012] The responding and handling the alarm information based on the alarm information handling decision tree to achieve handling of the security alarm over time includes:

[0013] Based on the processing steps and the processing methods corresponding to the processing steps in the alarm information processing decision tree, respond to the alarm system information;

[0014] Record the treatment process and the treatment results of each treatment step in the treatment process.

[0015] Optionally, after recording the treatment process and the treatment results of each treatment step in the treatment process, the method further includes:

[0016] Constructing an alarm answer prompt word according to the alarm information, the handling process and the handling results of each handling step in the handling process;

[0017] Input the alarm answer prompt words into the safety big model, so that the safety big model performs processing and analysis on the alarm information based on the processing flow and the processing results of each processing step in the processing flow, and obtains the processing and analysis information output by the safety big model;

[0018] The disposal analysis information is sent to the management terminal of the asset side corresponding to the alarm system information.

[0019] Optionally, before collecting security alarm events by using a collection component deployed on each asset side, the method further includes:

[0020] Acquire original training data, wherein the original training data includes network device data, terminal device data, threat intelligence data, code script data, security document data, security advice data, vulnerability data, and general corpus data;

[0021] Performing data preprocessing on the original training data to obtain training data, wherein the data preprocessing includes at least one of data cleaning, data deduplication, data noise reduction, data standardization, data segmentation, and stop word removal;

[0022] Based on the training data, pre-training, one-stage fine-tuning training and two-stage fine-tuning training are performed on the initial security big model to obtain the security big model.

[0023] Optionally, pre-training the initial large security model includes:

[0024] Constructing an initial security macro model including a gating mechanism model and a plurality of expert models, wherein the gating mechanism model is used to select an expert model to be used based on input data;

[0025] Obtain first training data from the training data, and pre-train the initial security large model based on the first training data, wherein for each first training data, the first training data is input into the gating mechanism model, the gating mechanism model is used to output a sparse activation vector, and the expert model corresponding to the activation vector is trained based on the first training data.

[0026] Optionally, a one-stage fine-tuning training is performed on the initial large security model, including:

[0027] Obtaining second training data from the training data, and constructing first multi-task training data based on the second training data, wherein the second training data includes a large amount of unlabeled data and a small amount of labeled data, and the multi-task includes at least attack traffic identification, attack type judgment, and judgment of whether the attack is successful;

[0028] A one-stage fine-tuning training is performed on the pre-trained initial security large model based on the multi-task training data.

[0029] Optionally, the initial large security model is subjected to a two-stage fine-tuning training, including:

[0030] Acquire third training data from the training data, and construct second multi-task training data based on the third training data, wherein the third training data is labeled data;

[0031] With the optimization goal of shortening the distance between enhanced versions of training data of the same training data on different tasks in the embedding space and increasing the distance between different training data in the embedding space, the initial secure large model after the first-stage fine-tuning training is subjected to a second-stage fine-tuning training using the third training data to obtain the trained secure large model.

[0032] Optionally, after obtaining the large security model, the method further includes:

[0033] Using the large security model as a teacher model, performing knowledge distillation on the teacher model to obtain knowledge information of the teacher model, training a student model based on the knowledge information, and replacing the large security model with the trained student model;

[0034] Perform at least one operation of model quantization, model pruning, and model optimization based on an attention mechanism on the secure large model.

[0035] According to another aspect of the present application, a device for analyzing and handling alarms based on a large security model is provided, the device comprising:

[0036] The alarm module is used to collect security alarm events through the collection components deployed on each asset side to obtain alarm information;

[0037] An analysis module is used to fill in an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and disposal decision tree sample information of the security big model, the instruction description information is used to guide the security big model to output an alarm information disposal decision tree based on a thinking chain, and the disposal decision tree sample information is used to provide a demonstration example of an alarm information disposal decision tree based on a thinking chain for the security big model; and,

[0038] Inputting the alarm analysis prompt word into the security big model, so as to generate an alarm information handling decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the handling decision tree sample information through the security big model;

[0039] A handling module is used to respond to and handle the alarm information based on the alarm information handling decision tree to achieve the handling of the security alarm event.

[0040] Optionally, the alarm information handling decision tree includes multiple handling steps based on the thought chain and a handling method corresponding to each handling step, wherein the handling steps include confirming whether the attack is successful, obtaining detailed attack information, confirming whether the attacking IP is a malicious IP, blocking the malicious IP, and checking and killing the compromised assets, and the handling method includes at least database query and API interface call;

[0041] The handling module is also used to: respond to and handle the alarm system information based on each handling step and the handling method corresponding to each handling step in the alarm information handling decision tree; record the handling process and the handling results of each handling step in the handling process.

[0042] Optionally, the processing module is further used to:

[0043] Constructing an alarm answer prompt word according to the alarm information, the handling process and the handling results of each handling step in the handling process;

[0044] Input the alarm answer prompt words into the safety big model, so that the safety big model performs processing and analysis on the alarm information based on the processing flow and the processing results of each processing step in the processing flow, and obtains the processing and analysis information output by the safety big model;

[0045] The disposal analysis information is sent to the management terminal of the asset side corresponding to the alarm system information.

[0046] Optionally, the device further comprises: a training module, configured to:

[0047] Acquire original training data, wherein the original training data includes network device data, terminal device data, threat intelligence data, code script data, security document data, security advice data, vulnerability data, and general corpus data;

[0048] Performing data preprocessing on the original training data to obtain training data, wherein the data preprocessing includes at least one of data cleaning, data deduplication, data noise reduction, data standardization, data segmentation, and stop word removal;

[0049] Based on the training data, pre-training, one-stage fine-tuning training and two-stage fine-tuning training are performed on the initial security big model to obtain the security big model.

[0050] Optionally, the training module is further used to:

[0051] Constructing an initial security macro model including a gating mechanism model and a plurality of expert models, wherein the gating mechanism model is used to select an expert model to be used based on input data;

[0052] Obtain first training data from the training data, and pre-train the initial security large model based on the first training data, wherein for each first training data, the first training data is input into the gating mechanism model, the gating mechanism model is used to output a sparse activation vector, and the expert model corresponding to the activation vector is trained based on the first training data.

[0053] Optionally, the training module is further used to:

[0054] Obtaining second training data from the training data, and constructing first multi-task training data based on the second training data, wherein the second training data includes a large amount of unlabeled data and a small amount of labeled data, and the multi-task includes at least attack traffic identification, attack type judgment, and judgment of whether the attack is successful;

[0055] A one-stage fine-tuning training is performed on the pre-trained initial security large model based on the multi-task training data.

[0056] Optionally, the training module is further used to:

[0057] Acquire third training data from the training data, and construct second multi-task training data based on the third training data, wherein the third training data is labeled data;

[0058] With the optimization goal of shortening the distance between enhanced versions of training data of the same training data on different tasks in the embedding space and increasing the distance between different training data in the embedding space, the initial secure large model after the first-stage fine-tuning training is subjected to a second-stage fine-tuning training using the third training data to obtain the trained secure large model.

[0059] Optionally, the training module is further used to:

[0060] Using the large security model as a teacher model, performing knowledge distillation on the teacher model to obtain knowledge information of the teacher model, training a student model based on the knowledge information, and replacing the large security model with the trained student model;

[0061] Perform at least one operation of model quantization, model pruning, and model optimization based on an attention mechanism on the secure large model.

[0062] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned alarm analysis and disposal method based on the security big model is implemented.

[0063] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned alarm analysis and disposal method based on the security big model when executing the program.

[0064] By means of the above technical scheme, the embodiment of the present application provides an alarm analysis and disposal method, device, storage medium and computer equipment based on a security big model, which collects security alarm events through the collection components deployed on each asset side, generates alarm analysis prompt words using the alarm analysis template, and introduces the security big model for analysis and disposal. The embodiment of the present application significantly improves the efficiency and accuracy of security alarm processing by automatically collecting, analyzing and disposing alarm information, reduces the need for manual intervention, and reduces the risk of human error. The security big model can handle complex and changeable alarm information, and generate corresponding disposal decision trees according to different situations. This flexibility enables the solution to adapt to the security needs of different assets and different systems. At the same time, the intelligence of the model enables it to continuously optimize and improve the disposal strategy. In addition, through a unified alarm analysis template and collection components, unified management and analysis of alarm information between different assets and different systems are achieved, which helps to break information silos and improve the coordination and efficiency of security operation and maintenance. The large security model has been trained with a large amount of security data and has strong generalization capabilities. It can process unseen alarm information and generate reasonable handling decision trees. In addition, since the model is centrally trained, the cost of training the model separately for each asset or system is reduced. In summary, the embodiments of the present application not only improve the handling efficiency and accuracy, but also enhance the flexibility and intelligence of the solution, and solve many problems existing in traditional methods.

[0065] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0067] Figure 1 A schematic diagram of a process of an alarm analysis and disposal method based on a security big model provided in an embodiment of the present application is shown;

[0068] Figure 2 A flow chart of another alarm analysis and disposal method based on a large security model provided in an embodiment of the present application is shown;

[0069] Figure 3 A flow chart of another alarm analysis and disposal method based on a large security model provided in an embodiment of the present application is shown;

[0070] Figure 4 A schematic diagram of the structure of an alarm analysis and disposal device based on a large security model provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0071] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0072] In this embodiment, a method for analyzing and handling alarms based on a large security model is provided. Figure 1 As shown, the method includes:

[0073] Step 101: Collect security alarm events through the collection components deployed on each asset side to obtain alarm information.

[0074] Step 102: fill in an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and handling decision tree sample information of the security big model, the instruction description information is used to guide the security big model to output an alarm information handling decision tree based on a thinking chain, and the handling decision tree sample information is used to provide the security big model with a demonstration example of an alarm information handling decision tree based on a thinking chain.

[0075] Step 103: input the alarm analysis prompt word into the security big model, so as to generate an alarm information handling decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the handling decision tree sample information through the security big model.

[0076] Step 104: respond to and handle the alarm information based on the alarm information handling decision tree to handle the security alarm event.

[0077] The embodiment of the present application proposes an alarm analysis and disposal method based on a large security model, aiming to improve the efficiency and accuracy of security alarm processing, while solving the problems of insufficient flexibility and intelligence, information islands, high model training costs and poor generalization capabilities in traditional methods. First, through the collection components deployed on each asset side, security alarm events are collected in real time or regularly and converted into structured alarm information. These alarm information contains detailed information of security events, such as event type, occurrence time, impact range, etc. Next, based on the collected alarm information, a preset alarm analysis template is filled. This template contains the identity description information of the large security model (used to identify the model identity and authority), instruction description information (used to guide the model how to generate a disposal decision tree) and disposal decision tree sample information (providing one or more disposal decision tree demonstration examples based on the thinking chain for the model to help the model understand the expected output format). The filled alarm analysis prompt words are input into the large security model. The large security model is a large neural network model trained with a large amount of security data, which can understand and process complex alarm information. Based on the identity description information, instruction description information and disposal decision tree sample information, the model can generate a disposal decision tree for the current alarm information. This decision tree contains a series of steps and judgment conditions from alarm identification to final disposal. Finally, according to the generated alarm information disposal decision tree, the alarm information is responded to and disposed. This may include isolating the affected assets, initiating the emergency response process, notifying relevant personnel, etc. By automatically executing these disposal steps, security alarm events can be handled quickly and accurately.

[0078] By applying the technical solution of this embodiment, security alarm events are collected by the collection components deployed on each asset side, alarm analysis prompt words are generated using the alarm analysis template, and the security big model is introduced for judgment and disposal. The embodiment of the present application significantly improves the efficiency and accuracy of security alarm processing by automatically collecting, analyzing and disposing alarm information, reducing the need for manual intervention and reducing the risk of human error. The security big model can handle complex and changeable alarm information and generate corresponding disposal decision trees according to different situations. This flexibility enables the solution to adapt to the security requirements of different assets and different systems. At the same time, the intelligence of the model enables it to continuously optimize and improve the disposal strategy. In addition, through the unified alarm analysis template and collection components, the unified management and analysis of alarm information between different assets and different systems is realized, which helps to break the information island and improve the coordination and efficiency of security operation and maintenance. The security big model has been trained with a large amount of security data and has a strong generalization ability. It can handle unseen alarm information and generate a reasonable disposal decision tree. In addition, since the model is centrally trained, the cost of training the model separately for each asset or system is reduced. In summary, the embodiments of the present application not only improve the processing efficiency and accuracy, but also enhance the flexibility and intelligence of the solution, and solve many problems existing in traditional methods.

[0079] Further, as a refinement and expansion of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another alarm analysis and disposal method based on the security big model is provided. The alarm information disposal decision tree includes multiple disposal steps based on the thinking chain and the disposal method corresponding to each disposal step. The disposal steps include confirming whether the attack is successful, obtaining attack details, confirming whether the attack IP is a malicious IP, blocking the malicious IP, and detecting and killing the compromised assets. The disposal method at least includes database query and API interface call, such as Figure 2 As shown, the method includes:

[0080] Step 201: respond to and handle the alarm system information based on each handling step in the alarm information handling decision tree and the handling method corresponding to each handling step; record the handling process and the handling results of each handling step in the handling process.

[0081] Step 202: construct alarm answer prompt words according to the alarm information, the handling process and the handling results of each handling step in the handling process; input the alarm answer prompt words into the security big model, so that the security big model handles and analyzes the alarm information based on the handling process and the handling results of each handling step in the handling process, and obtains the handling analysis information output by the security big model; and send the handling analysis information to the management terminal on the asset side corresponding to the alarm system information.

[0082] In the above scheme, after receiving the alarm information and generating the alarm information handling decision tree corresponding to the alarm information using the security big model, the handling response is performed according to the alarm information handling decision tree. Each node in the decision tree represents a handling step, such as confirming whether the attack is successful, obtaining attack details, confirming whether the attack IP is a malicious IP, etc. For each handling step, the system selects the corresponding handling method for execution. For example, the handling steps include: 1. To confirm whether the attack is successful, it is necessary to call the LLM data packet interpretation API; 2. To obtain the attack details, it is necessary to query the database related asset information and threat intelligence; 3. To confirm whether the IP is a malicious IP, it is necessary to query the database blacklist and whitelist; 4. To block the malicious IP, it is necessary to call the IP blocking API; 5. To detect and kill the compromised assets, it is necessary to call the EDR killing API. The handling method may include database query (such as querying the known malicious IP list, querying the asset information database, querying the intelligence information database, and querying the IP blacklist database) and API interface call (such as calling the API of the security device for IP blocking and calling the API for EDR killing). After executing each handling step, the system records the handling result of the step. These results may include query results (such as whether the IP is in the malicious IP list), return values ​​of API calls (such as whether the blocking operation is successful), etc. The system also records the entire handling process for subsequent analysis and auditing. Furthermore, based on the alarm information, handling process, and the handling results of each handling step, the system automatically constructs alarm answer prompts. This prompt contains detailed information about the alarm, the measures taken during the handling process, and the handling results of each measure. The construction of prompts helps the security big model to understand the context and handling process of the alarm more accurately. The constructed alarm answer prompts are input into the security big model, which is trained based on a large amount of network security data and knowledge and can understand and analyze complex network security issues. The security big model handles and analyzes the alarm information based on the input prompts. The analysis process may involve evaluation of the severity of the alarm, the intention of the attacker, the importance of the attacked assets, etc. Finally, the security big model outputs the handling analysis information so that the entire handling process and the handling results of each handling step are explained in natural language, which is convenient for users to understand the alarm information and the handling process of the alarm information. Finally, the system sends the disposal and analysis information output by the security model to the management terminal on the asset side corresponding to the alarm information, so that the asset administrator can promptly understand the details of the alarm, the disposal process, and the analysis results of the security model. The administrator can make more accurate decisions based on this information, such as whether additional security reinforcement is needed, whether an emergency response plan needs to be initiated, etc. In the embodiment of the present application, the system can automatically respond to the alarm information through the preset alarm information disposal decision tree without manual intervention, thereby improving the disposal efficiency and shortening the response time.The security big model is trained based on a large amount of network security data and knowledge, and can accurately understand and analyze complex network security issues. Through the analysis of the security big model, the system can provide more accurate disposal suggestions and security suggestions, thereby improving the accuracy of disposal. By integrating the disposal process and disposal results of the alarm information and the analysis results of the security big model into the management terminal, the system can provide a comprehensive security management view, which helps administrators better understand the security status of the system and optimize the security management process.

[0083] In the embodiment of the present application, optionally, Figure 3 As shown, it also includes:

[0084] Step 301: Obtain original training data, wherein the original training data includes network device data, terminal device data, threat intelligence data, code script data, security document data, security recommendation data, vulnerability data, and general corpus data.

[0085] In this embodiment, the types of raw data for large model training are divided into eight types, namely network device data, terminal device data, threat intelligence data, code script data, security document data, security recommendation data, vulnerability data and general corpus data. The collected data is stored in the data lake in JSON or CSV format.

[0086] Network equipment data specifically includes the following information: SIP situational awareness: vulnerability, service detection, host detection, website attack, backdoor communication, account blasting, attack exploitation, email attack, DOS attack, vulnerability exploitation, hacker tools, abnormal traffic. AF firewall: website attack, vulnerability attack, business risk, DOS attack, ransomware mining, botnet, abnormal traffic. -STA probe: protocol, NetFlow, small amount of payload. -SIP situational awareness / AF firewall / STA probe: suspicious log. Cloud mirror: asset and vulnerability data.

[0087] Terminal device data specifically includes the following information: EDR / CWPP: traditional antivirus logs and IOA logs. Windows: process information, network connections, DNS queries, registry modifications, file behaviors, service information, scheduled tasks, account information, WMI (Windows Management Instrumentation), application vulnerability exploit probes, API information. Linux: files, processes, drivers, system calls, module events, vulnerabilities.

[0088] Threat intelligence data specifically includes the following information: IP, domain name intelligence: APT, real threat-related IOC intelligence information. PDNS information: domain name resolution logs over the past period of time. Domain name registration information: including whois information, domain name service provider information, email, phone number and other information.

[0089] Code script data specifically includes the following information: Malicious scripts: including but not limited to webshell scripts, malicious shell scripts, etc. Script fragments with vulnerabilities: business fragments with vulnerabilities written in various languages, with vulnerability explanations. And problematic code fragments generated by dynamic and static vulnerability scanning tools. Open source code: open source code fragments from the open source community.

[0090] The security document data specifically includes the following information: ATT&CK: description of attack chain techniques and tactics and application examples; traditional engine solutions: traditional rules, engine development logic and documents; security encyclopedia: contains various security terminology explanations, blogs, papers and other text data; security recommendation data specifically includes the following information: Security incident handling recommendations: handling methods and event analysis documents for various security incidents generated by cloud security hosting services; false positive feedback: false positive data marked by cloud security experts; attack chain tracing report: tracing analysis report conducted by cloud security experts when handling security incidents, which effectively reflects the real intrusion path.

[0091] Vulnerability data specifically includes the following information: Internet vulnerability intelligence: vulnerability information publicly available on the Internet, including but not limited to POC intelligence, vulnerability blogs, and vulnerability reproduction principle analysis; CVE vulnerability information: public vulnerability information captured in real time.

[0092] Step 302: preprocess the original training data to obtain training data, wherein the data preprocessing includes at least one of data cleaning, data deduplication, data noise reduction, data standardization, data segmentation, and stop word removal.

[0093] In this embodiment, in addition to the diversity of data and the amount of data, high-quality data is also necessary to determine the effectiveness of the large model. Data preprocessing plays a vital role in the field of natural language processing (NLP) security. First, data preprocessing helps to clean and normalize text data, thereby reducing potential security risks. By removing malicious code, tokenizing text, and filtering sensitive information, the risk of malicious attacks and data leakage can be effectively reduced. Secondly, data preprocessing can help build a more robust and reliable NLP security model. By removing noise data, processing missing values, and balancing data sets, the accuracy and robustness of the model can be improved, thereby better responding to security threats. Finally, data preprocessing also helps to protect user privacy and comply with relevant regulations. Through means such as anonymization, desensitization, and encryption, user personal information can be effectively protected to ensure the compliance and security of the data processing process. Among them, the data deduplication stage of the large model mainly goes through the following four steps: 1) Language model modeling, using the n-gram model to model the original corpus and map each document to a vector; 2) Rule and heuristic filtering, such as retaining only lines with valid punctuation, discarding lines with too many symbols, or deleting documents containing banned words; 3) ML-based quality filtering, using lightweight models trained on known golden data to identify similar high-quality data documents; 4) Deduplication, deleting completely repeated spans or similar documents. Data denoising: Remove unnecessary punctuation and symbols from the original data, and parse and decode the original data (such as HTTP traffic parsing, base64, url, etc. decoding). Data normalization and standardization: Organize the above processed data into a standard and unified data format for model training. Data toeknization (data segmentation): After obtaining the cleaned data, segment the words through a custom-trained word segmenter to convert the text into a digital vector. The customized word segmenter is mainly trained from massive data using the WordPiece algorithm, which can not only effectively shorten the vector length, but also make the segmented text more interpretable, improving the learning efficiency of large models. Remove stop words: Collect illegal words to form a stop word set, and delete or replace related words. At the same time, the tf-idf algorithm is used to filter out and remove words that are not expected to be discriminative, so as to ensure the training efficiency of the model. Finally, training data is generated based on the above processed data.

[0094] Step 303: pre-train, perform one-stage fine-tuning training and two-stage fine-tuning training on the initial security big model based on the training data to obtain the security big model.

[0095] In this embodiment, with the training data, the next step is to feed this data information into the model to convert useful security knowledge, thereby improving the detection effect of the security big model in security scenarios. Compared with the two-stage training method (pre-training + fine-tuning) of the general big model, the security big model adopts a three-stage training method. The first stage is also unsupervised pre-training of large-scale corpus (security + general). The purpose of this stage is to let the big model understand what is security. The second stage of fine-tuning adopts the architecture of Mixture of Experts and the form of multi-task head, so that the big model can understand the detection tasks in the security scenario (such as what kind of traffic is an attack, what type of attack, whether the attack is successful, etc.). In the third stage, through the comparative learning method, the various types in the detection task have a larger distance in the high-dimensional feature space, making the model more robust and greatly reducing the model's hallucination problem.

[0096] Among them, pre-training the initial security big model includes: constructing an initial security big model including a gating mechanism model and multiple expert models, wherein the gating mechanism model is used to select the expert model to be used based on input data; obtaining the first training data in the training data, and pre-training the initial security big model based on the first training data, wherein for each first training data, the first training data is input into the gating mechanism model, the gating mechanism model is used to output a sparse activation vector, and the expert model corresponding to the activation vector is trained based on the first training data.

[0097] In the pre-training stage, the model is pre-trained using the processed massive security-related data. Here, the model architecture uses a mixture of experts, and each expert model is trained with different data. And because the model parameters are huge, in order to improve the training efficiency of the model, the detection of large models is accelerated by combining data parallelism, tensor parallelism, and pipeline parallelism. Among them, Mixture of experts is a deep learning model architecture based on a sparse MoE layer. That is, the large model is split into multiple small models (experts). Each round of iteration decides to activate a part of the experts for calculation according to the sample, achieving the effect of saving computing resources; and a gate mechanism that can be trained and ensures sparsity is introduced to ensure the optimization of computing power.

[0098] Among them, the initial security big model is subjected to a one-stage fine-tuning training, including: obtaining second training data from the training data, and constructing first multi-task training data based on the second training data, wherein the second training data includes a large amount of unlabeled data and a small amount of labeled data, and the multi-tasks include at least attack traffic identification, attack type judgment, and judgment of whether the attack is successful; based on the multi-task training data, the pre-trained initial security big model is subjected to a one-stage fine-tuning training.

[0099] In the first stage of fine-tuning training, by mixing massive unlabeled data and a small amount of labeled security scenario data, using semi-supervised learning strategies, data of different quality from different sources is efficiently utilized. This method of joint supervised training and self-supervised learning objectives helps solve the problem of mismatch between pre-training and downstream tasks, allowing large models to have certain general security capabilities. At the same time, the multi-task head mode enables the large model to understand the detection tasks in the security scenario (such as what kind of traffic is, what type of attack is, whether the attack is successful, etc.). Multi-task learning: If there are n tasks (traditional deep learning methods aim to solve only one task using a specific model), and these n tasks or a subset of them are related to each other but not exactly the same, it is called multi-task learning (MTL). By using the knowledge contained in all n tasks, it will help improve the learning of a specific model. Semi-supervised learning: Semi-supervised learning uses a large amount of unlabeled data, as well as labeled data at the same time, to perform pattern recognition work. When using semi-supervised learning, it will require as few people as possible to do the work, while at the same time, it can bring relatively high accuracy.

[0100] Among them, the initial security big model is subjected to two-stage fine-tuning training, including: obtaining third training data from the training data, constructing second multi-task training data based on the third training data, wherein the third training data is labeled data; with the optimization goal of shortening the distance in the embedding space of enhanced version training data of the same training data on different tasks and increasing the distance in the embedding space of different training data, the initial security big model after the one-stage fine-tuning training is subjected to two-stage fine-tuning training using the third training data to obtain the trained security big model.

[0101] In the second-stage fine-tuning training phase, the model can further improve its performance in security adversarial scenarios by using high-quality labeled data and difficult sample data, and adding contrastive learning auxiliary tasks. At the same time, it can enhance the robustness of the large security detection model in different downstream tasks. Contrastive learning is a method to improve the robustness of the model. Its optimization goal is to make different, enhanced new samples of a sample as close as possible in the embedding space, and make different samples as far apart as possible.

[0102] Step 304: Use the large security model as a teacher model, perform knowledge distillation on the teacher model to obtain knowledge information of the teacher model, train a student model based on the knowledge information, and replace the large security model with the trained student model; perform at least one of model quantization, model pruning, and attention-based model optimization on the large security model.

[0103] In this embodiment, in order to make the large model adapt to the background of large traffic throughput in various security detection task scenarios, specific acceleration means are not available. The detection large model mainly uses four means to improve the reasoning performance, namely knowledge distillation, model quantization, model pruning and attention mechanism optimization. Among them, knowledge distillation is a method of model compression. Different from pruning and quantization in model compression, knowledge distillation is to build a lightweight small model and use the supervision information of the large model with better performance to train the small model in order to achieve better performance and accuracy. The large model with higher complexity can be called teacher, and the small model with lower complexity than the large model can be called student. The goal of the student model is to reduce the computing cost while maintaining performance. The teacher model is used to predict the training set to obtain the soft target (i.e., the predicted probability distribution). The soft target provides richer information than the hard label (i.e., one-hot encoding), which helps the student model learn more subtle category differences. The soft target of the teacher model is used to train the student model, and the loss of the student model can also be calculated in combination with the hard label. By adjusting the parameters of the student model, its output is as close as possible to the soft target of the teacher model. When training the student model, the predicted probability of the teacher model is used as the soft target, and the parameters of the student model are updated by calculating the loss (such as KL divergence or cross entropy) between the output of the student model and the soft target of the teacher model. In the process of knowledge distillation, it is usually necessary to consider both the distillation loss (the difference between the student model and the teacher model) and the student loss (the difference between the student model and the true label). By adjusting the weights of these two losses, it can be ensured that the student model can learn the knowledge of the teacher model while maintaining sensitivity to the true label. Furthermore, at least one of model quantization, model pruning, and Attention mechanism optimization can be performed. Model quantization is defined as quantizing network parameters (mainly weights and activation values) from FLOAT32 to a lower number of bits, such as float16, INT8, INT4, etc. Its advantages include reduced memory usage (when 1M parameters are stored in FLOAT32, they will occupy 4MB of storage space, while storing them in INT8 will only take 1 / 4 of the space, i.e. 1M), lower power consumption, faster computing speed, etc. In deep neural networks, model pruning is an optimization technique that aims to reduce the number of parameters in a neural network, thereby improving the model's reasoning efficiency and reducing storage requirements. Pruning achieves this goal by removing redundant connections or parameters in the network while keeping the model's performance as unaffected as possible. The large security model uses structured pruning technology to prune certain neurons or channels that have little impact on detection capabilities, in order to achieve the goal of reducing the model size while controlling the loss of model capabilities.The process of pruning a large model for secure GPT detection is usually divided into the following steps: Initialize the model: Train a version of the secure large model (i.e., the secure large model obtained by the student model mentioned above), which contains a large number of parameters. Evaluate the importance of parameters: Use certain criteria to evaluate the importance of each parameter in the network. These criteria may include the size of the weight, the information of the gradient, the activity, etc. Some common methods include L1 regularization, sensitivity analysis, etc. Prune: Remove a part of the parameters according to the importance criteria of the evaluation, which can be the removal of the entire structure or the elimination of individual weights. Fine-tuning: After pruning, fine-tune the remaining model to maintain model performance. Through pruning technology, the secure large model reduces the size of the deep neural network, thereby increasing the inference speed and reducing the storage requirements while maintaining the performance of the model. In large language models, Attention is a key mechanism that improves the model's ability to pay attention to different positions in the input sequence, allowing the model to better handle long-distance dependencies. The basic idea of ​​the Attention mechanism is that when generating each output, the model can dynamically pay attention to different parts of the input sequence instead of relying solely on fixed context information. The Attention mechanism in large language models usually adopts the Self-Attention mechanism, in which each input position has a corresponding weight for calculating the contextual representation of the weighted sum. The Transformer model is a typical example of using the Self-Attention mechanism. In the large model of secure GPT detection, the Attention mechanism is optimized by the following means: Multi-Head Attention: Use multiple independent attention heads, each head learns different representations of queries, keys, and values. This helps the model capture multiple different attention directions and improves the expressiveness of the model. Scaled Dot-Product Attention: When calculating the attention score, divide by a scaling factor, usually the square root of the query or key dimension, to prevent the dot product value from becoming too large and reduce the risk of gradient vanishing. Positional Encoding: Since the Self-Attention mechanism does not consider the order of the input sequence, positional encoding needs to be introduced to provide the model with information about the position of the word to preserve the order information of the sequence.

[0104] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides an alarm analysis and disposal device based on a large security model, such as Figure 4 As shown, the device comprises:

[0105] The alarm module is used to collect security alarm events through the collection components deployed on each asset side to obtain alarm information;

[0106] An analysis module is used to fill in an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and disposal decision tree sample information of the security big model, the instruction description information is used to guide the security big model to output an alarm information disposal decision tree based on a thinking chain, and the disposal decision tree sample information is used to provide a demonstration example of an alarm information disposal decision tree based on a thinking chain for the security big model; and,

[0107] Inputting the alarm analysis prompt word into the security big model, so as to generate an alarm information handling decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the handling decision tree sample information through the security big model;

[0108] A handling module is used to respond to and handle the alarm information based on the alarm information handling decision tree to achieve the handling of the security alarm event.

[0109] Optionally, the alarm information handling decision tree includes multiple handling steps based on the thought chain and a handling method corresponding to each handling step, wherein the handling steps include confirming whether the attack is successful, obtaining detailed attack information, confirming whether the attacking IP is a malicious IP, blocking the malicious IP, and checking and killing the compromised assets, and the handling method includes at least database query and API interface call;

[0110] The handling module is also used to: respond to and handle the alarm system information based on each handling step and the handling method corresponding to each handling step in the alarm information handling decision tree; record the handling process and the handling results of each handling step in the handling process.

[0111] Optionally, the processing module is further used to:

[0112] Constructing an alarm answer prompt word according to the alarm information, the handling process and the handling results of each handling step in the handling process;

[0113] Input the alarm answer prompt words into the safety big model, so that the safety big model performs processing and analysis on the alarm information based on the processing flow and the processing results of each processing step in the processing flow, and obtains the processing and analysis information output by the safety big model;

[0114] The disposal analysis information is sent to the management terminal of the asset side corresponding to the alarm system information.

[0115] Optionally, the device further comprises: a training module, configured to:

[0116] Acquire original training data, wherein the original training data includes network device data, terminal device data, threat intelligence data, code script data, security document data, security advice data, vulnerability data, and general corpus data;

[0117] Performing data preprocessing on the original training data to obtain training data, wherein the data preprocessing includes at least one of data cleaning, data deduplication, data noise reduction, data standardization, data segmentation, and stop word removal;

[0118] Based on the training data, pre-training, one-stage fine-tuning training and two-stage fine-tuning training are performed on the initial security big model to obtain the security big model.

[0119] Optionally, the training module is further used to:

[0120] Constructing an initial security macro model including a gating mechanism model and a plurality of expert models, wherein the gating mechanism model is used to select an expert model to be used based on input data;

[0121] Obtain first training data from the training data, and pre-train the initial security large model based on the first training data, wherein for each first training data, the first training data is input into the gating mechanism model, the gating mechanism model is used to output a sparse activation vector, and the expert model corresponding to the activation vector is trained based on the first training data.

[0122] Optionally, the training module is further used to:

[0123] Obtaining second training data from the training data, and constructing first multi-task training data based on the second training data, wherein the second training data includes a large amount of unlabeled data and a small amount of labeled data, and the multi-task includes at least attack traffic identification, attack type judgment, and judgment of whether the attack is successful;

[0124] A one-stage fine-tuning training is performed on the pre-trained initial security large model based on the multi-task training data.

[0125] Optionally, the training module is further used to:

[0126] Acquire third training data from the training data, and construct second multi-task training data based on the third training data, wherein the third training data is labeled data;

[0127] With the optimization goal of shortening the distance between enhanced versions of training data of the same training data on different tasks in the embedding space and increasing the distance between different training data in the embedding space, the initial secure large model after the first-stage fine-tuning training is subjected to a second-stage fine-tuning training using the third training data to obtain the trained secure large model.

[0128] Optionally, the training module is further used to:

[0129] Using the large security model as a teacher model, performing knowledge distillation on the teacher model to obtain knowledge information of the teacher model, training a student model based on the knowledge information, and replacing the large security model with the trained student model;

[0130] Perform at least one operation of model quantization, model pruning, and model optimization based on an attention mechanism on the secure large model.

[0131] It should be noted that for other corresponding descriptions of the functional units involved in the alarm analysis and disposal device based on the security big model provided in the embodiment of the present application, reference can be made to Figures 1 to 3 The corresponding description in the method will not be repeated here.

[0132] The embodiment of the present application also provides a computer device, which can be a personal computer, a server, a network device, etc. The computer device includes a bus, a processor, a memory and a communication interface, and can also include an input and output interface and a display device. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store location information. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in each method embodiment are implemented.

[0133] Those skilled in the art will appreciate that the structure of the above-mentioned computer device is only a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components, or combine certain components, or have a different arrangement of components.

[0134] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0135] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0136] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0137] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0138] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0139] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for analyzing and handling alarms based on a large security model, characterized in that: The method comprises: The security alarm events are collected through the collection components deployed on each asset side to obtain alarm information; Filling an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and handling decision tree sample information of the security big model, the instruction description information is used to guide the security big model to output an alarm information handling decision tree based on a thinking chain, and the handling decision tree sample information is used to provide a demonstration example of an alarm information handling decision tree based on a thinking chain for the security big model; Input the alarm analysis prompt word into the security big model, so as to generate an alarm information handling decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the handling decision tree sample information through the security big model, wherein the alarm information handling decision tree includes a plurality of handling steps based on a thinking chain and a handling method corresponding to each handling step; The alarm information is responded to and handled based on the alarm information handling decision tree to achieve the handling of the security alarm event, including: responding to and handling the alarm information based on each handling step in the alarm information handling decision tree and the handling method corresponding to each handling step; recording the handling process and the handling results of each handling step in the handling process.

2. The method according to claim 1, characterized in that The disposal steps include confirming whether the attack is successful, obtaining attack details, confirming whether the attacking IP is a malicious IP, blocking the malicious IP, and checking and killing the compromised assets. The disposal method includes at least database query and API interface call.

3. The method according to claim 2, characterized in that After recording the treatment process and the treatment results of each treatment step in the treatment process, the method further includes: Constructing an alarm answer prompt word according to the alarm information, the handling process and the handling results of each handling step in the handling process; Input the alarm answer prompt words into the safety big model, so that the safety big model performs processing and analysis on the alarm information based on the processing flow and the processing results of each processing step in the processing flow, and obtains the processing and analysis information output by the safety big model; The disposal analysis information is sent to the management terminal of the asset side corresponding to the alarm information.

4. The method according to any one of claims 1 to 3, characterized in that Before collecting security warning events by using the collection components deployed on each asset side, the method further includes: Acquire original training data, wherein the original training data includes network device data, terminal device data, threat intelligence data, code script data, security document data, security advice data, vulnerability data, and general corpus data; Performing data preprocessing on the original training data to obtain training data, wherein the data preprocessing includes at least one of data cleaning, data deduplication, data noise reduction, data standardization, data segmentation, and stop word removal; Based on the training data, pre-training, one-stage fine-tuning training and two-stage fine-tuning training are performed on the initial security big model to obtain the security big model.

5. The method according to claim 4, characterized in that Pre-training the initial security model includes: Constructing an initial security macro model including a gating mechanism model and a plurality of expert models, wherein the gating mechanism model is used to select an expert model to be used based on input data; Obtain first training data from the training data, and pre-train the initial security large model based on the first training data, wherein for each first training data, the first training data is input into the gating mechanism model, the gating mechanism model is used to output a sparse activation vector, and the expert model corresponding to the activation vector is trained based on the first training data.

6. The method according to claim 4, characterized in that The initial security model is subjected to a one-stage fine-tuning training, including: Obtaining second training data from the training data, and constructing first multi-task training data based on the second training data, wherein the second training data includes a large amount of unlabeled data and a small amount of labeled data, and the multi-task includes at least attack traffic identification, attack type judgment, and judgment of whether the attack is successful; A one-stage fine-tuning training is performed on the pre-trained initial security large model based on the multi-task training data.

7. The method according to claim 4, characterized in that The initial large security model is subjected to two-stage fine-tuning training, including: Acquire third training data from the training data, and construct second multi-task training data based on the third training data, wherein the third training data is labeled data; With the optimization goal of shortening the distance between enhanced versions of training data of the same training data on different tasks in the embedding space and increasing the distance between different training data in the embedding space, the initial secure large model after the first-stage fine-tuning training is subjected to a second-stage fine-tuning training using the third training data to obtain the trained secure large model.

8. The method according to claim 4, characterized in that After obtaining the large security model, the method further comprises: Using the large security model as a teacher model, performing knowledge distillation on the teacher model to obtain knowledge information of the teacher model, training a student model based on the knowledge information, and replacing the large security model with the trained student model; Perform at least one operation of model quantization, model pruning, and model optimization based on an attention mechanism on the secure large model.

9. An alarm analysis and disposal device based on a large security model, characterized in that: The device comprises: The alarm module is used to collect security alarm events through the collection components deployed on each asset side to obtain alarm information; An analysis module is used to fill in an alarm analysis template based on the alarm information to obtain an alarm analysis prompt word, wherein the alarm analysis template includes identity description information, instruction description information, and disposal decision tree sample information of the security big model, the instruction description information is used to guide the security big model to output an alarm information disposal decision tree based on a thinking chain, and the disposal decision tree sample information is used to provide a demonstration example of an alarm information disposal decision tree based on a thinking chain for the security big model; and, Input the alarm analysis prompt word into the security big model, so as to generate an alarm information handling decision tree corresponding to the alarm information based on the identity description information, the instruction description information and the handling decision tree sample information through the security big model, wherein the alarm information handling decision tree includes a plurality of handling steps based on a thinking chain and a handling method corresponding to each handling step; A handling module is used to respond to and handle the alarm information based on the alarm information handling decision tree to achieve the handling of the security alarm event; wherein, the alarm information is responded to and handled in sequence based on each handling step in the alarm information handling decision tree and the handling method corresponding to each handling step; and the handling process and the handling results of each handling step in the handling process are recorded.

10. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

Images