Network security teaching method and device, equipment and storage medium

Abstract

The invention discloses a network security teaching method, device and equipment and a storage medium, relates to the technical field of network security, and can improve the attack and defense skills of network security scholars and reduce the teaching cost of network security. The scheme comprises the following steps: acquiring task indexes of current network attack and defense teaching demonstration and current environment information; the task index and the current environment information are input into a target processing engine, the target processing engine is used for calling a target large language model, a corresponding attack strategy is generated based on the target large language model according to the task index and the current environment information, and the target large language model is a large language model enhanced through a network security knowledge base; executing the attack strategy by using the target processing engine, and obtaining a corresponding execution result; and inputting the execution result into the target large language model to update the attack strategy according to the execution result and the task index by using the target large language model until the task index is completed according to the current updated attack strategy.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security teaching method, device, equipment and storage medium. Background Art

[0002] Capture the Flag (CTF) is a popular form of cybersecurity competition, usually held in cybersecurity conferences or educational environments. This competition simulates real cybersecurity attack and defense scenarios, and participants need to use their skills to discover and exploit security vulnerabilities in the system to capture the opponent's "flag".

[0003] In current cybersecurity teaching, students often manually capture the flag. This form can certainly enhance students' hands-on practical ability, but for students with weak overall attack and defense capabilities, it is still difficult to implement. If experts are used to assist and guide, the cost is high. Summary of the invention

[0004] The present application provides a network security teaching method, apparatus, device and storage medium, which can improve the attack and defense skills of network security scholars and reduce the teaching cost of network security.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect of an embodiment of the present application, a network security teaching method is provided, the method comprising:

[0007] Obtaining task indicators and current environment information of the current network attack and defense teaching demonstration, wherein the task indicators include the overall goal, the node goal, and the evaluation indicators corresponding to the node goal, and the current environment information includes: network environment information and system environment information;

[0008] Inputting the task indicator and the current environment information into the target processing engine, using the target processing engine to call a target large language model, and generating a corresponding attack strategy based on the target large language model according to the task indicator and the current environment information, wherein the target large language model is a large language model enhanced by a network security knowledge base;

[0009] The target processing engine executes the attack strategy and obtains the corresponding execution result;

[0010] The target processing engine calls the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator until the task indicator is completed according to the current updated attack strategy.

[0011] As a possible implementation, the attack strategy includes: multiple attack methods and processing tools corresponding to each of the attack methods;

[0012] The using the target processing engine to execute the attack strategy includes: using the target processing engine to call the processing tool to execute the corresponding attack method.

[0013] As a possible implementation, before obtaining the task indicator of the current network attack and defense teaching demonstration, the method further includes:

[0014] Acquire network security information, the network security information including multiple types of network security files, network security competition information, CTF competition information and network vulnerability information;

[0015] If the network security information includes media information, converting the media information into text information to obtain a first data set after the network security information is processed;

[0016] Preprocessing the first data set to obtain a second data set, wherein the preprocessing includes: cleaning, formatting, deduplication and standardization;

[0017] The second data set is encoded based on the Embedding model to generate the network security knowledge base.

[0018] As a possible implementation manner, encoding the second data set based on the Embedding model to generate the network security knowledge base includes:

[0019] Performing word segmentation processing on the second data set to obtain a third data set;

[0020] After determining the entities, relations and description contents in the third data set, performing information summary processing on the description contents in the third data set to obtain a fourth data set;

[0021] Using Graph Embedding to encode the fourth data set to obtain a fifth data set;

[0022] Using Vector Embedding to encode the fourth data set to obtain a sixth data set;

[0023] The fifth data set and the sixth data set are stored according to a corresponding relationship to obtain the network security knowledge base.

[0024] As a possible implementation, before obtaining the task indicator of the current network attack and defense teaching demonstration, the method further includes:

[0025] Acquire first environment data in a CTF competition based on an execution device, wherein the first environment data includes code information, system logs, and network traffic, and the execution device has a function of restoring network attack and defense manipulation;

[0026] Preprocessing the first environment data to obtain second environment data, wherein the preprocessing includes: cleaning processing, formatting processing and standardization processing;

[0027] The current environment information is determined based on the second environment data.

[0028] As a possible implementation manner, the determining the current environment information based on the second environment data includes:

[0029] Calling the target large prediction model to identify the second environment data to obtain third environment data, wherein the third environment data includes network environment data and system environment data, wherein the network environment data includes network topology relationship and intranet network relationship, and the system environment data includes system hardware and software, system language and execution environment;

[0030] The current environment information is determined based on the third environment data.

[0031] As a possible implementation manner, determining the current environment information based on the third environment data includes:

[0032] Performing data summary processing on the network environment data and the system environment data to obtain fourth environment data;

[0033] Processing the fourth environment data using the Prompt technology in the target large language model to obtain fifth environment data;

[0034] The fifth environment data is formatted to obtain the current environment information.

[0035] In a second aspect of an embodiment of the present application, a network security teaching device is provided, the device comprising:

[0036] An acquisition module is used to acquire the task indicators and current environment information of the current network attack and defense teaching demonstration, wherein the task indicators include the overall goal, the node goal and the evaluation indicators corresponding to the node goal, and the current environment information includes: network environment information and system environment information;

[0037] A generation module, used to input the task indicator and the current environment information into the target processing engine, use the target processing engine to call the target large language model, and generate a corresponding attack strategy based on the target large language model according to the task indicator and the current environment information, wherein the target large language model is a large language model enhanced by a network security knowledge base;

[0038] An execution module, used for the target processing engine to execute the attack strategy and obtain the corresponding execution result;

[0039] An updating module is used for the target processing engine to call the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator until the task indicator is completed according to the current updated attack strategy.

[0040] According to a third aspect of an embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the network security teaching method according to the first aspect of the embodiment of the present application is implemented.

[0041] In a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network security teaching method in the first aspect of the embodiments of the present application is implemented.

[0042] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0043] The network security teaching method provided by the embodiment of the present application, by obtaining the task indicators and current environment information of the current network attack and defense teaching demonstration, the task indicators include the overall goal, the node target and the evaluation indicators corresponding to the node target, and the current environment information includes: network environment information and system environment information; the task indicators and the current environment information are input into the target processing engine, the target processing engine calls the target large language model, and generates the corresponding attack strategy based on the target large language model according to the task indicators and the current environment information, and the target large language model is a large language model enhanced by the network security knowledge base; the target processing engine executes the attack strategy and obtains the corresponding execution result; the target processing engine calls the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator, until the task indicator is completed according to the current updated attack strategy. The network security teaching method provided by the embodiment of the present application, through the processing engine with the large language model as the core to carry out the attack and defense competition, can provide an opportunity and place for observation of automated network attack and defense, can inspire scholars to think, improve the attack and defense skills of network security scholars, and can reduce the teaching cost of network security. In addition, the big prediction model in this application can automatically identify security vulnerabilities in the system by combining with the network security knowledge base, which can help non-expert users identify vulnerabilities and successfully get the flag, thus improving users' network security awareness. Furthermore, this application can help users assess the security risks of the system and take preventive measures by simulating attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A process of teaching network security provided in the embodiment of the present application Figure 1 ;

[0045] Figure 2 A process of a network security teaching method provided in the embodiment of the present application Figure 2 ;

[0046] Figure 3 A structural diagram of a network security teaching device provided in an embodiment of the present application;

[0047] Figure 4 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "plurality" means two or more.

[0050] Additionally, the use of “based on” or “according to” is meant to be open and inclusive, as a process, step, calculation, or other action “based on” or “according to” one or more conditions or values ​​may, in practice, be based on additional conditions or beyond values.

[0051] Capture the Flag (CTF) is a popular form of cybersecurity competition, usually held in cybersecurity conferences or educational environments. This competition simulates real cybersecurity attack and defense scenarios, and participants need to use their skills to discover and exploit security vulnerabilities in the system to capture the opponent's "flag".

[0052] In current cybersecurity teaching, students often manually capture the flag. This form can certainly enhance students' hands-on practical ability, but for students with weak overall attack and defense capabilities, it is still difficult to implement. If experts assist in guidance, the cost is high.

[0053] In addition, for this type of "capture the flag" competition, it is currently often led by attack and defense experts, and the attackers and defenders participate in person. This form has strong limitations. First, the attack and defense capabilities depend on the upper limit of the functional capabilities of both parties; second, during the attack and defense process, there is a lack of inspiring demonstrations and automated process copying, which is not conducive to the innovative inspiration and thinking of network security scholars.

[0054] In order to solve the above problems, the present application embodiment provides a network security teaching method, such as Figure 1 As shown, the method comprises the following steps:

[0055] Step 101, obtaining task indicators and current environment information of the current network attack and defense teaching demonstration, wherein the task indicators include overall goals, node goals, and evaluation indicators corresponding to the node goals, and the current environment information includes: network environment information and system environment information.

[0056] For example, the overall goal can be the exploration of the flag target and whether the flag is captured successfully. The node goal can be: detecting a vulnerability or performing a corresponding operation by exploiting a vulnerability. The evaluation indicator corresponding to the node goal can be: successfully detecting a vulnerability or successfully performing a corresponding operation by exploiting a vulnerability.

[0057] Step 102: input the task indicators and the current environment information into the target processing engine, use the target processing engine to call the target large language model, and generate a corresponding attack strategy based on the target large language model according to the task indicators and the current environment information, wherein the target large language model is a large language model enhanced by a network security knowledge base.

[0058] Among them, the Large Language Model (LLM) is a deep learning model trained with a large amount of text data, which can generate natural language text or understand the meaning of language text. The LLM model can handle a variety of natural language tasks, such as text classification, question answering, and dialogue, and is an important path to artificial intelligence. However, LLM often lacks background knowledge of specific industries and scenarios. Building a highly targeted specific knowledge base is a better way to achieve this. By using the cybersecurity knowledge base to make up for the lack of vertical field knowledge of LLM, an enhanced large language model is obtained.

[0059] The target processing engine can be an Agent intelligent body. An agent is a computer program based on a large language model that has the ability to plan and think, remember, use tool functions, and can autonomously complete a given task.

[0060] The attack strategy includes: multiple attack methods and processing tools corresponding to each of the attack methods.

[0061] Step 103: The target processing engine executes the attack strategy and obtains a corresponding execution result.

[0062] Optionally, the above-mentioned using the target processing engine to execute the attack strategy includes: using the target processing engine to call the processing tool to execute a corresponding attack method.

[0063] The attack strategy may include multiple attack steps, and one attack step may include multiple attack methods. When executing the attack strategy, the attack steps may be executed in sequence. Each attack step may include a corresponding execution result.

[0064] The attack strategy can be implemented in a virtual environment for the drill, where the virtual environment can usually be an electronic device or a server. Taking the server as an example, the server in the virtual environment has the same configuration as the actual server. The difference is that the server in the virtual environment has the function of restoring network attack and defense manipulation, so in the virtual environment, it can be verified whether certain tasks with a certain degree of harm can be carried out as expected, or how much harm they cause to the environment.

[0065] Step 104: The target processing engine calls the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator until the task indicator is completed according to the current updated attack strategy.

[0066] That is to say, the large language model can update the attack strategy according to the execution result of each attack step and the task indicator, and repeat the above execution and update process until the task indicator is completed according to the current updated attack strategy.

[0067] The network security teaching method provided by the embodiment of the present application, by obtaining the task indicators and current environment information of the current network attack and defense teaching demonstration, the task indicators include the overall goal, the node target and the evaluation indicators corresponding to the node target, and the current environment information includes: network environment information and system environment information; the task indicators and the current environment information are input into the target processing engine, the target processing engine is used to call the target large language model, and the corresponding attack strategy is generated based on the target large language model according to the task indicators and the current environment information, and the target large language model is a large language model enhanced by the network security knowledge base; the target processing engine executes the attack strategy and obtains the corresponding execution result; the target processing engine calls the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator, until the task indicator is completed according to the current updated attack strategy. The network security teaching method provided by the embodiment of the present application, through the processing engine with the large language model as the core to carry out the attack and defense competition, can provide an opportunity and place for watching automated network attack and defense, can inspire scholars to think, and improve learning efficiency. In addition, the large prediction model in this application can be combined with the network security knowledge base to automatically identify security vulnerabilities in the system, can assist non-expert users to identify vulnerabilities, and successfully get the flag, and enhance users' network security awareness. Furthermore, the application can help users assess the security risks of the system and take preventive measures by simulating attacks.

[0068] Optional, such as Figure 2 As shown, before obtaining the task index of the current network attack and defense teaching demonstration in the above step 101, the method also includes:

[0069] Step 201: Obtain network security information, where the network security information includes multiple types of network security files, network security competition information, CTF competition information, and network vulnerability information.

[0070] Among them, various types of network security files, network security competition information, CTF competition information, network vulnerability information and other network security related information can be collected to obtain network security information.

[0071] Step 202: If the network security information includes media information, convert the media information into text information to obtain a first data set after the network security information is processed.

[0072] Among them, media information includes audio information, video information and image information. If network security information includes media data, some tools can be used to convert it into text data first, and then preprocess it. For example, an image dataset can be identified as text data using an OCR tool.

[0073] Step 203: pre-process the first data set to obtain a second data set, wherein the pre-processing includes: cleaning, formatting, deduplication and standardization.

[0074] Step 204: Encode the second data set based on the Embedding model to generate the network security knowledge base.

[0075] Specifically, the process of encoding the second data set based on the Embedding model in step 204 to generate the network security knowledge base may be:

[0076] Performing word segmentation processing on the second data set to obtain a third data set;

[0077] After determining the entities, relations and description contents in the third data set, performing information summary processing on the description contents in the third data set to obtain a fourth data set;

[0078] Using Graph Embedding to encode the fourth data set to obtain a fifth data set;

[0079] Using Vector Embedding to encode the fourth data set to obtain a sixth data set;

[0080] The fifth data set and the sixth data set are stored according to a corresponding relationship to obtain the network security knowledge base.

[0081] Among them, the entity can be the subject of the behavior, the relationship can be the action information, and the description content can be network security competition materials, vulnerability libraries, detailed descriptions of the attack and defense process, etc.

[0082] It is understandable that data encoding generally adopts the Embedding method, embedding the data set and then storing it to achieve semantic association of the data set and prepare for the subsequent LLM to read the data set. This application adopts a combination of VectorEmbedding and Graph Embedding to realize the construction of a network security knowledge base. Among them, GraphEmbedding focuses on graph structure encoding and is good at storing and calculating information with topological relationships. This can improve the data completeness and accuracy of the network knowledge base, and further improve the detection ability of large language models.

[0083] In the actual implementation process, the preprocessed second data set is analyzed, and tools such as jieba or HanNLP can be used for word segmentation to obtain the third data set. Then, for the third data set, after the entities, relationships and content in the third data set are determined, the entities, relationships and network security-related descriptions in the third data set are summarized. The information summary mainly reduces a large amount of descriptions to a smaller amount of content to obtain the fourth data set.

[0084] For the fourth data set, initialize Graph Embedding, and then use Graph technology related technologies to form Graph Embedding with the summary information of the above entities, relationships and related content. For example, use Neo4j and other related technologies to store them in Graph and use them in subsequent retrieval. Then initialize Vector Embedding. Use VectorEmbedding related technologies to form Embedding with the above content. For example, use GloVe and other related technologies to store them in word embedding and use them in subsequent retrieval.

[0085] Build the correlation between Graph Embedding and Vector Embedding storage. Record the relationship between Graph Embedding and Vector Embedding for later retrieval, mainly associating content summary with content. Further, Vector Embedding and Graph Embedding can be distributed to form an index. The data set is indexed by semantics, that is, relevant knowledge can be retrieved according to semantics.

[0086] Optionally, before obtaining the task indicator of the current network attack and defense teaching demonstration, the method further includes:

[0087] Acquire first environment data in a CTF competition based on an execution device, wherein the first environment data includes code information, system logs, and network traffic, and the execution device has a function of restoring network attack and defense manipulation; preprocess the first environment data to obtain second environment data, wherein the preprocessing includes: cleaning processing, formatting processing, and standardization processing in sequence; determine the current environment information based on the second environment data.

[0088] It should be noted that before obtaining the first environment data in the CTF competition based on the execution device, it is necessary to build a virtual environment for the exercise, that is, the execution device. The virtual environment that can replace the actual flag capture can be constructed according to the exercise goals and requirements. The configuration of the virtual environment and the actual environment is exactly the same. The difference between the virtual environment is that it has the function of restoring network attack and defense manipulation. Therefore, in this virtual environment, it can be verified whether certain tasks with a certain degree of harm can be carried out as expected, or how much harm it causes to the environment.

[0089] Optionally, determining the current environment information based on the second environment data includes:

[0090] The target large prediction model is called to identify the second environment data to obtain third environment data, wherein the third environment data includes network environment data and system environment data, wherein the network environment data includes network topology relationships and intranet network relationships, and the system environment data includes system hardware and software, system language and execution environment; and the current environment information is determined based on the third environment data.

[0091] In the actual execution process, the current network environment, such as network topology, intranet network relationship, etc., can be perceived based on the second environment data combined with LLM's own capabilities. Then, based on the collected information and combined with LLM's own capabilities, the current operation and execution environment, that is, system environment data, such as system hardware and software, language environment, and the operation and execution environment of various commonly used computer tools such as Python and Golang's execution environment, can be perceived. This will facilitate the subsequent calling of related tools to execute actions as needed.

[0092] Optionally, determining the current environment information based on the third environment data includes:

[0093] The network environment data and the system environment data are processed by data summarization to obtain fourth environment data; the fourth environment data is processed by using the Prompt technology in the target large language model to obtain fifth environment data; the fifth environment data is formatted to obtain the current environment information.

[0094] In the actual execution process, LLM will further sort out and summarize the perceived network environment data and the system environment data, that is, summarize and generalize the network environment data and the system environment data using LLM. Specifically, using the Prompt method of a specific LLM, the network environment data and the system environment data are processed using Prompt technology, wherein Prompt technology is prompt word engineering, which is a processing process that LLM can better identify and understand. After highly targeted Prompt processing, LLM's interaction has higher efficiency and accuracy. After Prompt processing, construct a design, code and implementation for interaction with LLM as the core, and format the execution results. For example, json formatting is generally used to obtain a vulnerability identification engine.

[0095] The network security teaching method provided by the embodiment of the present application, by obtaining the task indicators and current environment information of the current network attack and defense teaching demonstration, the task indicators include the overall goal, the node target and the evaluation indicators corresponding to the node target, and the current environment information includes: network environment information and system environment information; input the task indicators and the current environment information into the target processing engine, use the target processing engine to call the target large language model, and generate the corresponding attack strategy based on the target large language model according to the task indicators and the current environment information, the target large language model is a large language model enhanced by the network security knowledge base; use the target processing engine to execute the attack strategy and obtain the corresponding execution result; input the execution result into the target large language model, so as to update the attack strategy according to the execution result and the task indicator using the target large language model, until the task indicator is completed according to the current updated attack strategy. The network security teaching method provided by the embodiment of the present application, through the processing engine with the large language model as the core to carry out the attack and defense competition, can provide an opportunity and place for watching automated network attack and defense, can inspire scholars to think, and improve learning efficiency. In addition, the large prediction model in this application can automatically identify security vulnerabilities in the system in combination with the network security knowledge base, can assist non-expert users to identify vulnerabilities, and successfully get the flag, and enhance the user's network security awareness. Furthermore, the application can help users assess the security risks of the system and take preventive measures by simulating attacks.

[0096] The network security teaching method provided in the embodiment of the present application can also provide an experimental platform for network security researchers to test and develop new security technologies and methods. And by ensuring that all operations are carried out within the legal and ethical framework, users can learn and practice in a compliant environment. Improve the robustness of the system and stimulate innovation. In addition, through continuous testing and optimization, it helps to improve the robustness of the system and its ability to resist attacks. Further, it can also inspire new network security ideas and solutions and promote technological innovation.

[0097] like Figure 3 As shown, an embodiment of the present application provides a network security teaching device, the device comprising:

[0098] The acquisition module 11 is used to obtain the task indicators and current environment information of the current network attack and defense teaching demonstration, wherein the task indicators include the overall goal, the node goal and the evaluation indicators corresponding to the node goal, and the current environment information includes: network environment information and system environment information;

[0099] A generation module 12, which is used to input the task indicator and the current environment information into the target processing engine, use the target processing engine to call the target large language model, and generate a corresponding attack strategy based on the target large language model according to the task indicator and the current environment information, wherein the target large language model is a large language model enhanced by a network security knowledge base;

[0100] An execution module 13, used for the target processing engine to execute the attack strategy and obtain the corresponding execution result;

[0101] The updating module 14 is used for the target processing engine to call the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator until the task indicator is completed according to the current updated attack strategy.

[0102] In one embodiment, the attack strategy includes: multiple attack methods and processing tools corresponding to each of the attack methods; the execution module 13 is specifically used to: use the target processing engine to call the processing tool to execute the corresponding attack method.

[0103] In one embodiment, the device further includes: a processing module 15, wherein the processing module 15 is configured to:

[0104] Acquire network security information, the network security information including multiple types of network security files, network security competition information, CTF competition information and network vulnerability information;

[0105] If the network security information includes media information, converting the media information into text information to obtain a first data set after the network security information is processed;

[0106] Preprocessing the first data set to obtain a second data set, wherein the preprocessing includes: cleaning, formatting, deduplication and standardization;

[0107] The second data set is encoded based on the Embedding model to generate the network security knowledge base.

[0108] In one embodiment, the processing module 15 is specifically used for:

[0109] Performing word segmentation processing on the second data set to obtain a third data set;

[0110] After determining the entities, relations and description contents in the third data set, performing information summary processing on the description contents in the third data set to obtain a fourth data set;

[0111] Using Graph Embedding to encode the fourth data set to obtain a fifth data set;

[0112] Using Vector Embedding to encode the fourth data set to obtain a sixth data set;

[0113] The fifth data set and the sixth data set are stored according to a corresponding relationship to obtain the network security knowledge base.

[0114] In one embodiment, the processing module 15 is further used for:

[0115] Acquire first environment data in a CTF competition based on an execution device, wherein the first environment data includes code information, system logs, and network traffic, and the execution device has a function of restoring network attack and defense manipulation;

[0116] Preprocessing the first environment data to obtain second environment data, wherein the preprocessing includes: cleaning processing, formatting processing and standardization processing;

[0117] The current environment information is determined based on the second environment data.

[0118] In one embodiment, the processing module 15 is specifically used for:

[0119] Calling the target large prediction model to identify the second environment data to obtain third environment data, wherein the third environment data includes network environment data and system environment data, wherein the network environment data includes network topology relationship and intranet network relationship, and the system environment data includes system hardware and software, system language and execution environment;

[0120] The current environment information is determined based on the third environment data.

[0121] In one embodiment, the processing module 15 is specifically used for:

[0122] Performing data summary processing on the network environment data and the system environment data to obtain fourth environment data;

[0123] Processing the fourth environment data using the Prompt technology in the target large language model to obtain fifth environment data;

[0124] The fifth environment data is formatted to obtain the current environment information.

[0125] The network security teaching device provided in this embodiment can execute the above network security teaching method embodiment, and its implementation principle and technical effect are similar, which will not be elaborated here.

[0126] For the specific definition of the network security teaching device, please refer to the definition of the network security teaching method above, which will not be repeated here. Each module in the above network security teaching device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor of the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0127] The executor of the network security teaching method provided in the embodiment of the present application may be an electronic device, which may be a computer device, a terminal device, a server or a server cluster, and the embodiment of the present application does not specifically limit this.

[0128] Figure 4 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown, the electronic device includes a processor and a memory connected via a system bus. The processor is used to provide computing and control capabilities. The memory may include a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The computer program can be executed by the processor to implement the steps of the network security teaching method provided in each of the above embodiments. The internal memory provides a cache operating environment for the operating system and the computer program in the non-volatile storage medium.

[0129] Those skilled in the art will understand that Figure 4 The internal structure diagram of the electronic device shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In another embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the network security teaching method in the embodiment of the present application are implemented.

[0131] In another embodiment of the present application, a computer program product is also provided. The computer program product includes computer instructions. When the computer instructions execute the various steps of the network security teaching method in the method flow shown in the above method embodiment.

[0132] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer execution instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with a medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0133] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A network security teaching method, characterized in that: The method comprises: Obtaining task indicators and current environment information of the current network attack and defense teaching demonstration, wherein the task indicators include the overall goal, the node goal, and the evaluation indicators corresponding to the node goal, and the current environment information includes: network environment information and system environment information; Inputting the task indicator and the current environment information into the target processing engine, using the target processing engine to call a target large language model, and generating a corresponding attack strategy based on the target large language model according to the task indicator and the current environment information, wherein the target large language model is a large language model enhanced by a network security knowledge base; The target processing engine executes the attack strategy and obtains the corresponding execution result; The target processing engine calls the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator until the task indicator is completed according to the current updated attack strategy.

2. The method according to claim 1, characterized in that The attack strategy includes: multiple attack methods and processing tools corresponding to each of the attack methods; The using the target processing engine to execute the attack strategy includes: using the target processing engine to call the processing tool to execute the corresponding attack method.

3. The method according to claim 1, characterized in that Before obtaining the task index of the current network attack and defense teaching demonstration, the method further includes: Acquire network security information, the network security information including multiple types of network security files, network security competition information, CTF competition information and network vulnerability information; If the network security information includes media information, converting the media information into text information to obtain a first data set after the network security information is processed; Preprocessing the first data set to obtain a second data set, wherein the preprocessing includes: cleaning, formatting, deduplication and standardization; The second data set is encoded based on the Embedding model to generate the network security knowledge base.

4. The method according to claim 3, characterized in that The encoding process of the second data set based on the Embedding model to generate the network security knowledge base includes: Performing word segmentation processing on the second data set to obtain a third data set; After determining the entities, relations and description contents in the third data set, performing information summary processing on the description contents in the third data set to obtain a fourth data set; Using Graph Embedding to encode the fourth data set to obtain a fifth data set; Using Vector Embedding to encode the fourth data set to obtain a sixth data set; The fifth data set and the sixth data set are stored according to a corresponding relationship to obtain the network security knowledge base.

5. The method according to claim 1, characterized in that Before obtaining the task index of the current network attack and defense teaching demonstration, the method further includes: Acquire first environment data in a CTF competition based on an execution device, wherein the first environment data includes code information, system logs, and network traffic, and the execution device has a function of restoring network attack and defense manipulation; Preprocessing the first environment data to obtain second environment data, wherein the preprocessing includes: cleaning processing, formatting processing and standardization processing; The current environment information is determined based on the second environment data.

6. The method according to claim 5, characterized in that The determining the current environment information based on the second environment data includes: Calling the target large prediction model to identify the second environment data to obtain third environment data, wherein the third environment data includes network environment data and system environment data, wherein the network environment data includes network topology relationship and intranet network relationship, and the system environment data includes system hardware and software, system language and execution environment; The current environment information is determined based on the third environment data.

7. The method according to claim 6, characterized in that The determining the current environment information based on the third environment data includes: Performing data summary processing on the network environment data and the system environment data to obtain fourth environment data; Processing the fourth environment data using the Prompt technology in the target large language model to obtain fifth environment data; The fifth environment data is formatted to obtain the current environment information.

8. A network security teaching device, characterized in that: The device comprises: An acquisition module is used to acquire the task indicators and current environment information of the current network attack and defense teaching demonstration, wherein the task indicators include the overall goal, the node goal and the evaluation indicators corresponding to the node goal, and the current environment information includes: network environment information and system environment information; A generation module, used to input the task indicator and the current environment information into the target processing engine, use the target processing engine to call the target large language model, and generate a corresponding attack strategy based on the target large language model according to the task indicator and the current environment information, wherein the target large language model is a large language model enhanced by a network security knowledge base; An execution module, used for the target processing engine to execute the attack strategy and obtain the corresponding execution result; An updating module is used for the target processing engine to call the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicator until the task indicator is completed according to the current updated attack strategy.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the network security teaching method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the network security teaching method according to any one of claims 1 to 7 is implemented.

Images