Method and system for improving question and answer ability of large model for network security field based on fine tuning of large model

Abstract

The invention relates to the technical field of artificial intelligence and network security, in particular to a method and system for improving the question answering ability of a large model for the network security field based on large model fine tuning, and the method comprises the following steps: constructing a network security field knowledge base; selecting an appropriate large model as a basic model; annotating data in the network security field; performing performance comparison under different fine adjustment methods; a fine tuning process of the Freeze method is optimized; carrying out model evaluation and optimization, and carrying out reinforcement learning; the method and the system for improving the question-answering ability of the large model in the network security field based on the large model fine tuning have the beneficial effects that the question-answering ability of the large model in the network security field can be remarkably improved through the method for improving the question-answering ability of the large model in the network security field based on the large model fine tuning; and a more accurate and comprehensive network security knowledge service is provided for the user.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence and network security technology, and specifically to a method and system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model. Background Art

[0002] With the rapid development of network technology, network security issues are becoming increasingly prominent, and the demand for knowledge in the field of network security is also growing. As an important technology in the field of artificial intelligence, large models have strong learning and reasoning capabilities, but they still face many challenges in question-answering applications in the field of network security, such as low accuracy of question-answering and incomplete answers. Therefore, how to improve the question-answering capabilities of large models in the field of network security is an issue that needs to be solved urgently.

[0003] With the continuous expansion of data sets and the improvement of computing power, training larger and more complex deep learning models has become a trend. However, in the process of large model training, the huge number of parameters has seriously restricted the efficiency and effect of model training. As for the disadvantages of full parameter fine-tuning, it mainly requires large computing resources and time. Since all parameters of the model need to be fine-tuned, this usually means that more computing resources are needed to support this process. At the same time, full parameter fine-tuning may also cause the model to overfit on some small-scale tasks, that is, the model performs well on the training data, but performs poorly on unseen data. Therefore, in order to improve the training efficiency of large model parameters, researchers have proposed a large model parameter efficient fine-tuning technology. This technology optimizes the update method of model parameters to achieve more efficient and stable model training. However, in the process of large model fine-tuning, there is an important problem, namely "catastrophic forgetting". Catastrophic forgetting is a problem that frequently occurs in the field of machine learning, especially in deep learning. When we continue to learn new tasks based on the existing model, the model may quickly forget the previously learned knowledge. This phenomenon is particularly common during the training and tuning of large language models, as these models often need to handle a large number of different types of tasks and data. The root cause of catastrophic forgetting lies in the updating of neural network weights. When learning a new task, the network weights are adjusted to adapt to the new data, however, this adjustment may destroy the knowledge of the old tasks represented by the original weights. Simply put, due to shared parameters, the new learning process may "overwrite" the old knowledge. Therefore, it is crucial to fine-tune large models on specific tasks and prevent catastrophic forgetting problems.

[0004] The efficient parameter fine-tuning methods mainly include the following: Freeze method, i.e. parameter freezing, freezes some parameters of the original model and trains only some parameters, so that the large model can be trained on a single card or multiple cards without TP or PP operations. However, training only some parameters will reduce the model's ability to fit new data. At the same time, how to select appropriate neural network layer parameters for freezing also requires continuous attempts; Lora method, i.e., adding additional low-rank matrices to the specified parameters (weight matrices) in parallel on a large language model, and only training the parameters of the additional parallel low-rank matrices during model training. When the "rank value" is much smaller than the original parameter dimension, the amount of newly added low-rank matrix parameters is also very small. When fine-tuning downstream tasks, only very small parameters need to be trained to obtain good performance results. However, using low-rank matrices to approximate the high-dimensional structure of the original model may introduce some approximation errors, which may affect the performance of the model on some tasks, especially those tasks or fields that require fine-grained understanding or are very different from the training distribution of the pre-trained model. Although Lora reduces the complexity of fine-tuning, it still requires a lot of computing resources for very large models or when adapting to a large number of tasks or domains; the principle of the P-Tuning method, namely Prefix Tuning fine-tuning, is mainly to guide the learning direction of the model by adding a learnable continuous vector as a prompt prefix at the beginning of the model input sequence. This prefix vector is continuously adjustable during the model training process, and its introduction enables the model to adapt to different downstream tasks by fine-tuning the prefix vector without changing the original model parameters. Specifically, Prefix Tuning can not only add prefix vectors to the input layer of the model, but also add a vector sequence before the key and value vectors in the Transformer self-attention module of each layer. These prefix vectors are solved by backpropagation, and they can affect each layer of the model, so that the model can better understand task-specific problems and improve the performance of the model. Compared with traditional full-scale fine-tuning, a significant advantage of P-Tuning is that it only needs to adjust a small number of parameters, namely the prefix vector, while the rest of the model remains unchanged. This means that the demand on computing resources is greatly reduced, so that large models can be effectively adjusted even with limited resources. In principle, P-Tuning can also effectively avoid the catastrophic forgetting problem. Since it only adjusts the prefix vector instead of the parameters of the entire model, it will not overwrite or destroy the knowledge learned by the original model during the learning process, thereby reducing the possibility of forgetting. However, this method lacks scale versatility, that is, for those smaller models (from 100M to 1B), the performance of P-Tuning and full fine-tuning is very different, which greatly limits the applicability of P-Tuning. In addition, due to the limitation of sequence length, the number of adjustable parameters is limited. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for improving the question-answering ability of a large model in the field of network security based on large model fine-tuning, so as to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, the method comprising the following steps:

[0007] Build a knowledge base in the field of network security;

[0008] Select a suitable large model as the base model;

[0009] Data annotation in the field of network security;

[0010] Performance comparison under different fine-tuning methods;

[0011] Freeze method fine-tuning process optimization;

[0012] Model evaluation and optimization: Based on the evaluation results, the model is further optimized to improve its performance in question-answering tasks in the field of network security, and the degree of catastrophic forgetting of the model is also evaluated;

[0013] Reinforce learning, deploy the optimized model to the question-answering system in the field of network security, continuously collect customer needs and questions, record samples with poor response quality, re-label relevant data, form a new fine-tuning data set, and continuously iterate and strengthen model capabilities.

[0014] Preferably, the specific operations of building a network security domain knowledge base include:

[0015] Collect professional knowledge, cases, and regulations in the field of cybersecurity to form a knowledge base in the field of cybersecurity and provide data support for subsequent model training;

[0016] Collect network traffic logs, network security related codes, scripts, and commands to provide data support for subsequent specific network security tasks;

[0017] The collected cybersecurity knowledge data is further cleaned, high-quality cybersecurity knowledge data is screened, and the data is reviewed for content.

[0018] Preferably, the specific operation of selecting a suitable large model as the basic model includes:

[0019] According to the characteristics of the question-answering task in the field of network security, a pre-trained large model is selected as the basic model, which has good language understanding and reasoning capabilities;

[0020] The ChatGLM series of models are excellent open-source Chinese-English bilingual dialogue models that support contextual dialogues of up to 32K in length, have more efficient reasoning speed and lower video memory usage, and the model versions are continuously upgraded and maintained.

[0021] Download the specified version of the model parameter file and dependent files from the ChatGLM official website, and call ChatGLM through the huggingface integration method to conduct intelligent dialogue;

[0022] Clone the open source training and fine-tuning code from ChatGLM's GitHub official website, and put the pre-downloaded model parameter files and dependency files into the code root directory.

[0023] Preferably, the specific operations of data annotation in the field of network security include:

[0024] Annotate the data in the cybersecurity knowledge base, including question types and answer keywords, for subsequent model training;

[0025] Customized answers to specific questions and data annotation for supervised learning tasks such as vulnerability analysis, traffic analysis, attack analysis, log analysis, code auditing, and security knowledge question and answer;

[0026] According to the fine-tuning document provided on the ChatGLM official website, adjust the input and output formats of the supervised dataset to adapt to the encoding and decoding process of the large model.

[0027] Preferably, the specific operations of comparing the performance under different fine-tuning methods include:

[0028] Use labeled cybersecurity data to fine-tune the basic model so that the model can better understand cybersecurity issues and give accurate answers.

[0029] Through the Freeze method, that is, the parameter freezing method, some parameters of the original model are frozen and only the remaining parameters are trained;

[0030] Through the P-Tuning method, namely the Prefix-Tuning method, new prefix parameters are added to the Embedding layer and each layer of the large model, and only these parameters are trained during the training process;

[0031] Through the Lora method, additional low-rank matrices are added in parallel to the specified parameters on the large language model, and during the model training process, only the parameters of the additional parallel low-rank matrices are trained; when the "rank value" is much smaller than the original parameter dimension, the number of newly added low-rank matrix parameters is also very small, and only very small parameters need to be trained to obtain better performance results.

[0032] A system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, the system comprising:

[0033] Knowledge base construction subsystem: used to collect, clean and filter professional knowledge, cases, regulatory data, network traffic logs, related codes, scripts and commands in the field of network security to form high-quality data sets;

[0034] Basic model selection subsystem: used to select a pre-trained large model with good language understanding and reasoning capabilities as the basic model, especially the ChatGLM series model or its updated version;

[0035] Data annotation subsystem: annotates the data in the network security knowledge base, including question types and answer keywords, to adapt to the encoding and decoding process of large models;

[0036] Fine-tuning subsystem: Use the labeled cybersecurity data to fine-tune the basic model. By comparing different parameter efficient fine-tuning methods, the most suitable fine-tuning strategy is selected and optimized to improve the model's question-answering capabilities in the cybersecurity field.

[0037] Performance evaluation and optimization subsystem: Evaluate the performance of the fine-tuned model on the test set, including question-answering accuracy and recall indicators, and further optimize the model based on the evaluation results, while evaluating and preventing catastrophic forgetting problems.

[0038] Preferably, during the Freeze fine-tuning process:

[0039] Implement a mixed data fine-tuning strategy: Mix pre-training data and fine-tuning data in different proportions, gradually increase the proportion of fine-tuning data, and use them in the fine-tuning process in turn to improve the model's ability to fit new data;

[0040] A step-by-step freezing strategy is introduced: starting from the fully connected layer of the model, the model is gradually unfrozen and the parameter update scale is gradually expanded according to the increase in the size of the fine-tuning dataset, so as to keep the model training degree, parameter update scale and the size of the fine-tuning dataset in sync, effectively preventing catastrophic forgetting.

[0041] Preferably, the system comprises:

[0042] Data set collection and cleaning module: collects relevant data in the field of network security and performs cleaning and screening;

[0043] Data annotation module: annotates the cleaned data to form a fine-tuning data set suitable for large model training;

[0044] Dataset management module: responsible for the storage, version control and update management of fine-tuning datasets.

[0045] Preferably, the system further comprises:

[0046] Performance evaluation module: This module evaluates the performance of the fine-tuned model on the test set, including the measurement of question-answering accuracy and recall rate.

[0047] Optimization strategy formulation module: formulate optimization strategies based on evaluation results, including adjusting fine-tuning strategies and optimizing model parameters;

[0048] Continuous iteration module: Continuously iterate and optimize the model based on new data and user feedback to ensure the model's continued efficient performance in question-answering tasks in the field of network security.

[0049] Preferably, the system comprises:

[0050] Model deployment module: deploys the optimized model to the network security question-answering system to provide services to users;

[0051] User feedback collection module: collects user needs and questions, and records samples with poor response quality;

[0052] Adaptive Optimization Module: Re-labels relevant data based on user feedback to form a new fine-tuning dataset, and automatically iterates the model to enhance the model's capabilities in question-answering tasks in the field of network security.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] The method and system for improving the question-answering ability of a large model in the field of network security based on fine-tuning of a large model proposed in the present invention can significantly improve the question-answering ability of a large model in the field of network security, and provide users with more accurate and comprehensive network security knowledge services. At the same time, the method of the present invention is also characterized by high flexibility and strong scalability, and can adapt to the needs of question-answering tasks in different network security fields.

[0055] Enhance professionalism in the field of cybersecurity: By fine-tuning the large model, it can have a deeper understanding of the professional terms, concepts and principles in the field of cybersecurity, thereby improving the accuracy and professionalism in cybersecurity question answering. This helps ensure that the model can give accurate and professional answers when answering cybersecurity-related questions, meeting the needs of experts and practitioners in the field of cybersecurity.

[0056] Fine-tuning of large models can optimize the performance of models in dealing with network security issues and improve the response speed and accuracy of question-answering systems. By specifically adjusting model parameters to make them more suitable for data distribution and problem characteristics in the network security field, the reasoning speed of the model can be accelerated and the possibility of misjudgment and missed judgment can be reduced.

[0057] The fine-tuned model can better handle various complex situations in the field of network security, including new attack methods, defense strategies, etc. By introducing more network security data for training, the model can learn more domain knowledge and experience, so that it can make more reasonable inferences and predictions when facing unknown problems.

[0058] By fine-tuning the large model, it can better understand the personalized needs of users. According to the different questions and backgrounds of different users, the model can give more personalized and accurate answers, improving user experience and satisfaction.

[0059] The method based on large model fine-tuning not only improves the performance of the question-answering system, but also provides new ideas and methods for technological innovation in the field of network security. This method can be applied to other network security-related tasks, such as intrusion detection and malware analysis, to promote the continuous development and progress of network security technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 is a flow chart of the method of the present invention;

[0061] Figure 2 The present invention is a flow chart for fine-tuning the Freeze method process optimization. DETAILED DESCRIPTION

[0062] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] For example, see Figure 1 to Figure 2 The present invention provides a technical solution: a method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, the method comprising the following steps:

[0064] 1. Build a knowledge base in the field of network security

[0065] 1) Collect professional knowledge, cases, regulations, etc. in the field of network security to form a knowledge base in the field of network security and provide data support for subsequent model training.

[0066] 2) Collect network traffic logs, network security related codes, scripts, and commands to provide data support for subsequent specific network security tasks.

[0067] 3) Further clean the collected cybersecurity knowledge data, screen high-quality cybersecurity knowledge data, and conduct content review of the data.

[0068] 2. Choose a suitable large model as the base model

[0069] 1) According to the characteristics of the question-answering task in the field of network security, a pre-trained large model is selected as the basic model, which should have good language understanding and reasoning capabilities.

[0070] 2) The ChatGLM series of models are excellent open source Chinese-English bilingual dialogue models that support contextual dialogues of up to 32K in length, have more efficient reasoning speed and lower video memory usage, and the model version is continuously upgraded and maintained.

[0071] 3) Download the specified version of the model parameter file and dependent files from the ChatGLM official website, and call ChatGLM through the huggingface integration method for intelligent dialogue.

[0072] 4) Clone the open source training and fine-tuning code from ChatGLM's GitHub official website, and put the model parameter files and dependency files downloaded in advance into the code root directory.

[0073] 3. Data annotation in the field of network security

[0074] 1) Label the data in the network security knowledge base, including question types, answer keywords, etc., for subsequent model training.

[0075] 2) Customized answers to specific questions and data annotation for supervised learning tasks such as vulnerability analysis, traffic analysis, attack analysis, log analysis, code auditing, and security knowledge Q&A.

[0076] 3) According to the fine-tuning document provided on the ChatGLM official website, adjust the input and output formats of the supervised dataset to adapt to the encoding and decoding process of the large model.

[0077] 4. Performance comparison under different fine-tuning methods

[0078] 1) Use labeled cybersecurity data to fine-tune the basic model so that the model can better understand problems in the cybersecurity field and give accurate answers.

[0079] 2) Through the Freeze method, that is, the parameter freezing method, some parameters of the original model are frozen and only the remaining parameters are trained.

[0080] 3) Through the P-Tuning method, namely the Prefix-Tuning method, new prefix parameters are added to the Embedding layer and each layer of the large model, and only these parameters are trained during the training process.

[0081] 4) Through the Lora method, additional low-rank matrices are added in parallel to the specified parameters (weight matrices) on the large language model, and during the model training process, only the parameters of the additional parallel low-rank matrices are trained. When the "rank value" is much smaller than the original parameter dimension, the number of newly added low-rank matrix parameters is also very small. Only very small parameters need to be trained to obtain better performance results.

[0082] 5. Freeze method fine-tuning process optimization

[0083] 1) Generally, Freeze fine-tuning only fine-tunes the fully connected layer parameters of the last few layers of Transformer and freezes all other parameters, because the fully connected layer parameters can capture longer-distance dependencies and global semantics, which can help the model understand and capture more complex security knowledge, traffic logs, security vulnerabilities and other advanced semantic information. However, it is easy to affect the original training curve of the large model, and the original knowledge is forgotten in the process of fitting new data. In order to make the model better fit the data in the field of network security, the present invention proposes to make the following improvements to the original Freeze fine-tuning method:

[0084] 2) When fine-tuning the parameters of the fully connected layer and freezing other parameters, the pre-training data and fine-tuning data are mixed in the ratio of 5:5, 4:6, and 3:7, and fed to the large model for fine-tuning in turn. At the same time, the number of fine-tuning rounds is continuously increased during the fine-tuning process so that the large model can gradually fit the new training data and prevent catastrophic forgetting of old knowledge.

[0085] 3) In addition, the parameter freezing process is frozen in stages. Starting from the last fully connected layer of the large model, the remaining fully connected layers are gradually unfrozen, and the parameter update scale is continuously expanded to better fit the increasing proportion of new data in the mixed fine-tuning dataset, and the model training degree, parameter update scale and fine-tuning dataset size are synchronized to better learn new network security knowledge data.

[0086] 6. Model evaluation and optimization

[0087] 1) Evaluate the performance of the fine-tuned model on the test set, including question-answering accuracy, recall, and other indicators. Based on the evaluation results, further optimize the model to improve its performance in the network security question-answering task. At the same time, evaluate the degree of catastrophic forgetting of the model.

[0088] 2) Evaluate the model performance after different fine-tuning methods, including catastrophic forgetting problem, model parameter size, computing resource usage, inference speed, etc.

[0089] 3) Compare the differences between the optimized Freeze fine-tuning method and the original fine-tuning method, and record the improvement of the optimized Freeze fine-tuning method at each stage.

[0090] 7. Reinforcement Learning

[0091] 1) Deploy the optimized model to the network security question-answering system to provide users with efficient and accurate question-answering services.

[0092] 2) Continuously collect customer needs and questions, record samples with poor response quality, re-label relevant data, form new fine-tuning data sets, and continuously iterate and enhance model capabilities.

[0093] Embodiment 2, based on embodiment 1, proposes a system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of the large model, the system comprising:

[0094] Knowledge base construction subsystem: used to collect, clean and filter professional knowledge, cases, regulatory data, network traffic logs, related codes, scripts and commands in the field of network security to form high-quality data sets;

[0095] Basic model selection subsystem: used to select a pre-trained large model with good language understanding and reasoning capabilities as the basic model, especially the ChatGLM series model or its updated version;

[0096] Data annotation subsystem: annotates the data in the network security knowledge base, including question types and answer keywords, to adapt to the encoding and decoding process of large models;

[0097] Fine-tuning subsystem: Use the labeled cybersecurity data to fine-tune the basic model. By comparing different parameter efficient fine-tuning methods, the most suitable fine-tuning strategy is selected and optimized to improve the model's question-answering capabilities in the cybersecurity field.

[0098] Performance evaluation and optimization subsystem: Evaluate the performance of the fine-tuned model on the test set, including question-answering accuracy and recall indicators, and further optimize the model based on the evaluation results, while evaluating and preventing catastrophic forgetting problems.

[0099] The system is in the Freeze fine-tuning process:

[0100] Implement a mixed data fine-tuning strategy: Mix pre-training data and fine-tuning data in different proportions, gradually increase the proportion of fine-tuning data, and use them in the fine-tuning process in turn to improve the model's ability to fit new data;

[0101] A step-by-step freezing strategy is introduced: starting from the fully connected layer of the model, the model is gradually unfrozen and the parameter update scale is gradually expanded according to the increase in the size of the fine-tuning dataset, so as to keep the model training degree, parameter update scale and the size of the fine-tuning dataset in sync, effectively preventing catastrophic forgetting.

[0102] The system includes:

[0103] Data set collection and cleaning module: collects relevant data in the field of network security and performs cleaning and screening;

[0104] Data annotation module: annotates the cleaned data to form a fine-tuning data set suitable for large model training;

[0105] Dataset management module: responsible for the storage, version control and update management of fine-tuning datasets.

[0106] The system also includes:

[0107] Performance evaluation module: This module evaluates the performance of the fine-tuned model on the test set, including the measurement of question-answering accuracy and recall rate.

[0108] Optimization strategy formulation module: formulate optimization strategies based on evaluation results, including adjusting fine-tuning strategies and optimizing model parameters;

[0109] Continuous iteration module: Continuously iterate and optimize the model based on new data and user feedback to ensure the model's continued efficient performance in question-answering tasks in the field of network security.

[0110] The system includes:

[0111] Model deployment module: deploys the optimized model to the network security question-answering system to provide services to users;

[0112] User feedback collection module: collects user needs and questions, and records samples with poor response quality;

[0113] Adaptive Optimization Module: Re-labels relevant data based on user feedback to form a new fine-tuning dataset, and automatically iterates the model to enhance the model's capabilities in question-answering tasks in the field of network security.

[0114] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of the large model, characterized by: The method comprises the following steps: Build a knowledge base in the field of network security; Select a suitable large model as the base model; Data annotation in the field of network security; Performance comparison under different fine-tuning methods; Freeze method fine-tuning process optimization; Model evaluation and optimization: Based on the evaluation results, the model is further optimized to improve its performance in question-answering tasks in the field of network security, and the degree of catastrophic forgetting of the model is also evaluated; Reinforce learning, deploy the optimized model to the question-answering system in the network security field, continuously collect customer needs and questions, record samples with poor response quality, re-label relevant data, form a new fine-tuning data set, and continuously iterate and strengthen model capabilities.

2. According to claim 1, a method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model is characterized by: The specific operations of building a knowledge base in the field of network security include: Collect professional knowledge, cases, and regulations in the field of cybersecurity to form a knowledge base in the field of cybersecurity and provide data support for subsequent model training; Collect network traffic logs, network security related codes, scripts, and commands to provide data support for subsequent specific network security tasks; The collected cybersecurity knowledge data is further cleaned, high-quality cybersecurity knowledge data is screened, and the data is reviewed for content.

3. According to claim 1, a method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model is characterized by: The specific operations of selecting a suitable large model as the base model include: According to the characteristics of the question-answering task in the field of network security, a pre-trained large model is selected as the basic model, which has good language understanding and reasoning capabilities; The ChatGLM series of models are excellent open-source Chinese-English bilingual dialogue models that support contextual dialogues of up to 32K in length, have more efficient reasoning speed and lower video memory usage, and the model versions are continuously upgraded and maintained. Download the specified version of the model parameter file and dependent files from the ChatGLM official website, and call ChatGLM through the huggingface integration method to conduct intelligent dialogue; Clone the open source training and fine-tuning code from ChatGLM's GitHub official website, and put the pre-downloaded model parameter files and dependency files into the code root directory.

4. According to claim 1, a method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model is characterized by: Specific operations of data annotation in the field of network security include: Annotate the data in the cybersecurity knowledge base, including question types and answer keywords, for subsequent model training; Customized answers to specific questions and data annotation for supervised learning tasks such as vulnerability analysis, traffic analysis, attack analysis, log analysis, code auditing, and security knowledge question and answer; According to the fine-tuning document provided on the ChatGLM official website, adjust the input and output formats of the supervised dataset to adapt to the encoding and decoding process of the large model.

5. According to claim 1, a method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model is characterized by: The specific operations for performance comparison under different fine-tuning methods include: Use labeled cybersecurity data to fine-tune the basic model so that the model can better understand cybersecurity issues and give accurate answers. Through the Freeze method, that is, the parameter freezing method, some parameters of the original model are frozen and only the remaining parameters are trained; Through the P-Tuning method, namely the Prefix-Tuning method, new prefix parameters are added to the Embedding layer and each layer of the large model, and only these parameters are trained during the training process; Through the Lora method, additional low-rank matrices are added in parallel to the specified parameters on the large language model, and during the model training process, only the parameters of the additional parallel low-rank matrices are trained; when the "rank value" is much smaller than the original parameter dimension, the number of newly added low-rank matrix parameters is also very small, and only very small parameters need to be trained to obtain better performance results.

6. A method for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model according to any one of claims 1 to 5, characterized in that: The system comprises: Knowledge base construction subsystem: used to collect, clean and filter professional knowledge, cases, regulatory data, network traffic logs, related codes, scripts and commands in the field of network security to form high-quality data sets; Basic model selection subsystem: used to select a pre-trained large model with good language understanding and reasoning capabilities as the basic model, especially the ChatGLM series model or its updated version; Data annotation subsystem: annotates the data in the network security knowledge base, including question types and answer keywords, to adapt to the encoding and decoding process of large models; Fine-tuning subsystem: Use the labeled cybersecurity data to fine-tune the basic model. By comparing different parameter efficient fine-tuning methods, the most suitable fine-tuning strategy is selected and optimized to improve the model's question-answering capabilities in the cybersecurity field. Performance evaluation and optimization subsystem: Evaluate the performance of the fine-tuned model on the test set, including question-answering accuracy and recall indicators, and further optimize the model based on the evaluation results, while evaluating and preventing catastrophic forgetting problems.

7. According to claim 6, a system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, characterized in that: The system is in the Freeze fine-tuning process: Implement a mixed data fine-tuning strategy: Mix pre-training data and fine-tuning data in different proportions, gradually increase the proportion of fine-tuning data, and use them in the fine-tuning process in turn to improve the model's ability to fit new data; Introducing step-by-step freezing Strategy: Start from the fully connected layer of the model and gradually unfreeze it. According to the increase of the size of the fine-tuning dataset, gradually expand the parameter update scale to keep the model training degree, parameter update scale and fine-tuning dataset size in sync, effectively preventing catastrophic forgetting.

8. According to claim 6, a system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, characterized in that: The system includes: Data set collection and cleaning module: collects relevant data in the field of network security and performs cleaning and screening; Data annotation module: annotates the cleaned data to form a fine-tuning data set suitable for large model training; Dataset management module: responsible for the storage, version control and update management of fine-tuning datasets.

9. According to claim 6, a system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, characterized in that: The system also includes: Performance evaluation module: This module evaluates the performance of the fine-tuned model on the test set, including the measurement of question-answering accuracy and recall rate. Optimization strategy formulation module: formulate optimization strategies based on evaluation results, including adjusting fine-tuning strategies and optimizing model parameters; Continuous iteration module: Continuously iterate and optimize the model based on new data and user feedback to ensure the model's continued efficient performance in question-answering tasks in the field of network security.

10. According to claim 6, a system for improving the question-answering capability of a large model in the field of network security based on fine-tuning of a large model, characterized in that: The system includes: Model deployment module: deploys the optimized model to the network security question-answering system to provide services to users; User feedback collection module: collects user needs and questions, and records samples with poor response quality; Adaptive Optimization Module: Re-labels relevant data based on user feedback to form a new fine-tuning dataset, and automatically iterates the model to enhance the model's capabilities in question-answering tasks in the field of network security.

Images