A network security teaching method, device, equipment and storage medium

Abstract

The application discloses a network security teaching method and device, equipment and a storage medium, relates to the technical field of network security, and can improve the attack and defense skills of network security scholars and reduce the teaching cost of network security. The scheme comprises the following steps: acquiring task indexes and current environment information of current network attack and defense teaching demonstration; inputting the task indexes and the current environment information into a target processing engine, calling a target large language model by using the target processing engine, and generating a corresponding attack strategy based on the target large language model according to the task indexes and the current environment information, wherein the target large language model is a large language model enhanced by using a network security knowledge base; executing the attack strategy by using the target processing engine, and acquiring a corresponding execution result; inputting the execution result into the target large language model, so as to update the attack strategy according to the execution result and the task indexes by using the target large language model, and until the task indexes are completed according to the current updated attack strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security teaching method and device, equipment and a storage medium. BACKGROUND

[0002] "Capture The Flag" (CTF) is a popular form of network security competition, usually held in network security conferences or educational environments. This competition simulates a real network security attack and defense scene, and participants need to use their skills to discover and exploit security vulnerabilities in the system to obtain the opponent's "flag".

[0003] In current network security teaching, students often manually implement capture the flag. This form can indeed enhance the students' hands-on practical ability, but for students who are not strong in overall attack and defense capabilities, the implementation difficulty is still great, and if assisted by experts, the cost is large. SUMMARY

[0004] The present application provides a network security teaching method, device, equipment and storage medium, which can improve the attack and defense skills of network security scholars and reduce the teaching cost of network security.

[0005] To achieve the above purpose, the present application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a network security teaching method, which comprises:

[0007] Obtaining task indicators and current environment information of the current network attack and defense teaching demonstration, the task indicators comprising total targets, node targets and evaluation indicators corresponding to the node targets, and the current environment information comprising network environment information and system environment information;

[0008] Inputting the task indicators and the current environment information into the target processing engine, calling a target large language model by the target processing engine, and generating a corresponding attack strategy based on the target large language model according to the task indicators and the current environment information, the target large language model being a large language model enhanced by a network security knowledge base;

[0009] The target processing engine executes the attack strategy and obtains a corresponding execution result;

[0010] The target processing engine calls the target large language model to update the attack strategy according to the execution result and the task indicators until the task indicators are completed according to the current updated attack strategy.

[0011] As a possible implementation manner, the attack strategy comprises a plurality of attack modes and processing tools corresponding to the attack modes.

[0012] The executing the attack strategy by using the target processing engine comprises invoking the processing tools by using the target processing engine to execute the corresponding attack modes.

[0013] As a possible implementation manner, before the acquiring the task index of the current network attack and defense teaching demonstration, the method further comprises:

[0014] Acquiring network security information, the network security information comprising a plurality of types of network security files, network security competition information, CTF competition information and network vulnerability information;

[0015] If the network security information comprises media information, the media information is converted into text information to obtain a first data set after processing of the network security information;

[0016] The first data set is preprocessed to obtain a second data set, the preprocessing comprising, in sequence, cleaning processing, formatting processing, deduplication processing and standardization processing;

[0017] The second data set is encoded based on an Embedding model to generate the network security knowledge base.

[0018] As a possible implementation manner, the encoding the second data set based on the Embedding model to generate the network security knowledge base comprises:

[0019] The second data set is subjected to word segmentation processing to obtain a third data set;

[0020] After determining entities, relationships and description contents in the third data set, the description contents in the third data set are subjected to information abstract processing to obtain a fourth data set;

[0021] The fourth data set is encoded by using Graph Embedding to obtain a fifth data set;

[0022] The fourth data set is encoded by using Vector Embedding to obtain a sixth data set;

[0023] The fifth data set and the sixth data set are stored according to a corresponding relationship to obtain the network security knowledge base.

[0024] As a possible implementation manner, before the acquiring the task index of the current network attack and defense teaching demonstration, the method further comprises:

[0025] Obtaining first environment data in a CTF competition based on an execution device, the first environment data including code information, system logs, and network traffic, the execution device having a function of network attack and defense manipulation reduction;

[0026] Preprocessing the first environment data to obtain second environment data, the preprocessing including cleaning processing, formatting processing, and standardization processing in sequence;

[0027] Determining the current environment information based on the second environment data.

[0028] As a possible implementation manner, the determining of the current environment information based on the second environment data includes:

[0029] Calling the target large language model to recognize the second environment data to obtain third environment data, the third environment data including network environment data and system environment data, the network environment data including network topology relationships and intranet network relationships, and the system environment data including system software and hardware, system language, and execution environment;

[0030] Determining the current environment information based on the third environment data.

[0031] As a possible implementation manner, the determining of the current environment information based on the third environment data includes:

[0032] Performing data summary processing on the network environment data and the system environment data to obtain fourth environment data;

[0033] Processing the fourth environment data by using Prompt technology in the target large language model to obtain fifth environment data;

[0034] Performing formatting processing on the fifth environment data to obtain the current environment information.

[0035] In a second aspect, a network security teaching device is provided, and the device includes:

[0036] An obtaining module is configured to obtain task indicators of a current network attack and defense teaching demonstration and current environment information, the task indicators including total targets, node targets, and evaluation indicators corresponding to the node targets, and the current environment information including network environment information and system environment information;

[0037] The generating module is configured to input the task index and the current environment information into the target processing engine, invoke a target large language model by using the target processing engine, and generate a corresponding attack strategy according to the task index and the current environment information based on the target large language model, the target large language model being a large language model enhanced by using a network security knowledge base;

[0038] The executing module is configured to execute the attack strategy by using the target processing engine, and obtain a corresponding execution result;

[0039] The updating module is configured to invoke the target large language model by using the target processing engine, so that the target large language model updates the attack strategy according to the execution result and the task index, until the task index is completed according to the current updated attack strategy.

[0040] In a third aspect, an electronic device is provided, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the network security teaching method in the first aspect is implemented.

[0041] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the network security teaching method in the first aspect is implemented.

[0042] The technical scheme provided by the embodiments of the present application has at least the following beneficial effects:

[0043] The network security teaching method provided by the embodiment of the application comprises the following steps: obtaining a task index and current environment information of a current network attack and defense teaching demonstration, the task index comprising a total target, a node target and an evaluation index corresponding to the node target, the current environment information comprising network environment information and system environment information; inputting the task index and the current environment information into a target processing engine; the target processing engine calling a target large language model and generating a corresponding attack strategy based on the target large language model according to the task index and the current environment information, the target large language model being a large language model enhanced by a network security knowledge base; the target processing engine executing the attack strategy and obtaining a corresponding execution result; the target processing engine calling the target large language model to enable the target large language model to update the attack strategy according to the execution result and the task index until the task index is completed according to the current updated attack strategy. The network security teaching method provided by the embodiment of the application can provide an opportunity and a place for automatic network attack and defense observation by using a processing engine with a large language model as the core to carry out attack and defense competitions, can inspire scholars to think, improve the attack and defense skills of network security scholars, and can reduce the teaching cost of network security. In addition, the large language model in the application can automatically identify security vulnerabilities in the system in combination with the network security knowledge base, can assist non-expert users in identifying vulnerabilities and successfully obtaining the flag, and can improve the network security awareness of users. Furthermore, the application can help users evaluate the security risks of the system by simulating attacks and taking measures for prevention. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The network security teaching method provided by the embodiment of the application Figure 1 ;

[0045] Figure 2 The network security teaching method provided by the embodiment of the application Figure 2 ;

[0046] Figure 3 The network security teaching device provided by the embodiment of the application

[0047] Figure 4 The network security teaching device provided by the embodiment of the application DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0049] Hereinafter, the terms "first", "second", "third", etc. are used only for descriptive purposes and cannot be construed as indicating or implying relative importance or an indicated number of technical features. Thus, features defined with "first", "second", etc. can explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise stated, the meaning of "a plurality of" is two or more.

[0050] In addition, the use of "based on" or "according to" means open and inclusive, because the process, step, calculation or other action "based on" or "according to" one or more conditions or values can be based on additional conditions or values in practice.

[0051] "Capture The Flag" (CTF) is a popular form of network security competition, usually held in network security conferences or educational environments. This competition simulates a real network security attack and defense scene, and participants need to use their skills to discover and exploit security vulnerabilities in the system to obtain the opponent's "flag".

[0052] In the current network security teaching, students often manually implement Capture The Flag. This form can certainly enhance the students' hands-on practical ability, but for students who are not good at overall attack and defense ability, the implementation difficulty is still great, and if assisted by experts, the cost is large.

[0053] In addition, for this type of "Capture The Flag" competition, the current attack and defense experts usually lead the attack and defense, and both sides participate in person. This form has strong limitations. First, the attack and defense ability depends on the upper limit of the functional ability of both sides; second, in the attack and defense process, there is a lack of heuristic demonstration and automated process imitation, which is not conducive to the innovative inspiration and thinking of network security scholars.

[0054] To solve the above problems, the embodiments of the present application provide a network security teaching method, as shown in Figure 1 The method comprises the following steps:

[0055] Step 101, obtaining the task index and current environment information of the current network attack and defense teaching demonstration, the task index comprising a total target, a node target and an evaluation index corresponding to the node target, and the current environment information comprising network environment information and system environment information.

[0056] For example, the total target can be the exploration of the flag target and whether the capture of the flag is successful. The node target can be: detecting a certain vulnerability or executing a corresponding operation by exploiting a certain vulnerability. The evaluation index corresponding to the node target can be: successfully detecting a certain vulnerability, or successfully executing a corresponding operation by exploiting a certain vulnerability.

[0057] Step 102, input the task indicator and the current environment information into the target processing engine, call a target large language model using the target processing engine, and generate a corresponding attack strategy based on the task indicator and the current environment information according to the target large language model, wherein the target large language model is a large language model enhanced using a network security knowledge base.

[0058] Among them, the large language model (Large Language Model, LLM) is a deep learning model trained using a large amount of text data, which can generate natural language text or understand the meaning of language text. LLM model can process various natural language tasks such as text classification, question answering, dialogue, etc., which is an important way to artificial intelligence. But LLM often lacks the background knowledge of specific industries and scenarios, and building a specific knowledge base with strong pertinence is a good way to achieve it. By using the network security knowledge base to make up for the lack of vertical field knowledge of LLM, an enhanced large language model is obtained.

[0059] The target processing engine can be an agent intelligent agent, which is a computer program based on a large language model, with the ability to plan and think, the ability to remember, and the ability to use tool functions, and can independently complete a given task.

[0060] Among them, the attack strategy includes a plurality of attack methods and corresponding processing tools for each attack method.

[0061] Step 103, the target processing engine executes the attack strategy and obtains the corresponding execution result.

[0062] Optionally, the above execution of the attack strategy using the target processing engine includes calling the processing tool to execute the corresponding attack method using the target processing engine.

[0063] Among them, the attack strategy can include a plurality of attack steps, and each attack step can include a plurality of attack methods, which can be executed in sequence according to the attack steps when executing the attack strategy. Each attack step can include a corresponding execution result.

[0064] The attack strategy can be implemented in a virtual environment for building a drill, wherein the virtual environment can usually be an electronic device or a server, etc. Taking the server as an example, the virtual environment server has the same configuration as the actual server. The difference is that the virtual environment server has the function of network attack and defense manipulation and restoration, so it can verify whether some tasks with a certain degree of harm can be carried out as expected, or how much harm they cause to the environment, etc.

[0065] Step 104, the target processing engine calls the target large language model, so that the target large language model updates the attack strategy according to the execution result and the task index until the task index is completed according to the current updated attack strategy.

[0066] That is, the large language model can update the attack strategy according to the execution result of each attack step and the task index, and repeatedly execute the above execution and update process until the task index is completed according to the current updated attack strategy.

[0067] The network security teaching method provided by the embodiment of the application, by obtaining the task index and the current environment information of the current network attack and defense teaching demonstration, the task index includes the total target, the node target and the evaluation index corresponding to the node target, and the current environment information includes: network environment information and system environment information; input the task index and the current environment information into the target processing engine, call the target large language model by the target processing engine, and generate the corresponding attack strategy based on the target large language model according to the task index and the current environment information, the target large language model is a large language model enhanced by using the network security knowledge base; the target processing engine executes the attack strategy, and obtains the corresponding execution result; the target processing engine calls the target large language model, so that the target large language model updates the attack strategy according to the execution result and the task index until the task index is completed according to the current updated attack strategy. The network security teaching method provided by the embodiment of the application can provide an opportunity and place for automatic network attack and defense through the processing engine taking the large language model as the core, can inspire scholars to think, and improve the learning efficiency. In addition, the large language model in the application can automatically identify security vulnerabilities in the system in combination with the network security knowledge base, can assist non-expert users to identify vulnerabilities, and successfully get the flag, and improve the user's network security awareness. Further, the application can help users evaluate the security risk of the system through simulated attacks, and take measures for prevention.

[0068] Optionally, as shown in Figure 2 Before the step 101 of obtaining the task index of the current network attack and defense teaching demonstration, the method further includes:

[0069] Step 201, obtaining network security information, the network security information includes a plurality of types of network security files, network security competition information, CTF competition information and network vulnerability information.

[0070] Among them, various types of network security files, network security competition information, CTF competition information, network vulnerability information and other network security related information can be collected to obtain network security information.

[0071] Step 202, if the network security information includes media information, converting the media information into text information to obtain a first data set of the processed network security information.

[0072] The media information includes audio information, video information and image information. If the network security information includes media data, some tools can be used to convert the media data into text data, and then the pre-processing is performed. For example, the picture data set can be recognized as text data by using an OCR tool.

[0073] Step 203, pre-processing the first data set to obtain a second data set, the pre-processing including cleaning processing, formatting processing, deduplication processing and standardization processing.

[0074] Step 204, encoding the second data set based on an Embedding model to generate the network security knowledge base.

[0075] Specifically, the process of Step 204 can be as follows:

[0076] performing word segmentation processing on the second data set to obtain a third data set;

[0077] after determining the entity, the relationship and the description content in the third data set, performing information abstract processing on the description content in the third data set to obtain a fourth data set;

[0078] performing encoding processing on the fourth data set by using Graph Embedding to obtain a fifth data set;

[0079] performing encoding processing on the fourth data set by using Vector Embedding to obtain a sixth data set;

[0080] storing the fifth data set and the sixth data set according to a corresponding relationship to obtain the network security knowledge base.

[0081] The entity can be the subject of the behavior, the relationship can be the action information, and the description content can be the network security competition data, the vulnerability library, the detailed description of the attack and defense process, etc.

[0082] It can be understood that data encoding generally adopts an Embedding method, and the data set is embedded and then stored, realizing semantic association of the data set and preparing for subsequent LLM reading of the data set. The application adopts a combination of Vector Embedding and Graph Embedding to realize construction of the network security knowledge base, wherein the Graph Embedding focuses on graph structure coding and is good at storing and calculating information with topological relationship, so that the data perfection and accuracy of the network knowledge base can be improved, and further the detection capability of the large language model can be improved.

[0083] In actual execution, the preprocessed second data set is analyzed, word segmentation is performed by using tools such as jieba or HanNLP to obtain a third data set, then entities, relationships and contents in the third data set are determined, and information summaries of the entities, relationships and network security related description contents in the third data set are performed, the information summary mainly reduces a large amount of description into a small amount of content, and a fourth data set is obtained.

[0084] For the fourth data set, Graph Embedding is initialized, then Graph technology related technologies are used to form Graph Embedding of the above-mentioned entities, relationships and summary information of the related contents, for example, related technologies such as Neo4j are used to store the Graph, and the Graph is used in subsequent retrieval. Then Vector Embedding is initialized. Vector Embedding related technologies are used to form Embedding of the above-mentioned contents, for example, related technologies such as GloVe are used to store the word embedding, and the word embedding is used in subsequent retrieval.

[0085] The related relationship of Graph Embedding and Vector Embedding storage is constructed. The relationship of Graph Embedding and Vector Embedding is recorded for later retrieval association, wherein the main content is content summary and content association. Further, Vector Embedding and Graph Embedding distribution can form an index. The data set is implemented according to semantic indexing, that is, the related knowledge can be retrieved according to semantics.

[0086] Optionally, before the task index of the current network attack and defense teaching demonstration is obtained, the method further includes:

[0087] Obtaining first environment data in a CTF competition based on an execution device, the first environment data including code information, system logs and network traffic, the execution device having a function of network attack and defense manipulation and restoration; preprocessing the first environment data to obtain second environment data, the preprocessing including cleaning processing, formatting processing and standardization processing in sequence; determining the current environment information based on the second environment data.

[0088] It should be noted that before obtaining the first environment data in the CTF competition based on the execution device, a virtual environment for the drill also needs to be built, that is, the execution device can build a virtual environment that can replace the actual flag capture according to the drill target and requirements. The virtual environment and the actual environment are completely consistent in configuration. The difference between the virtual environment and the actual environment is that the virtual environment has the function of network attack and defense manipulation and restoration, so that whether certain tasks with a certain degree of harm can be performed as expected or the degree of harm caused by the tasks to the environment can be verified in the virtual environment.

[0089] Optionally, the determining of the current environment information based on the second environment data comprises:

[0090] Calling the target large language model to recognize the second environment data to obtain third environment data, the third environment data including network environment data and system environment data, the network environment data including network topology relationship and intranet network relationship, and the system environment data including system software and hardware, system language and execution environment; determining the current environment information based on the third environment data.

[0091] In actual execution, the current network environment such as network topology relationship and intranet network relationship can be perceived according to the second environment data and the LLM itself. Then, according to the collected information and the LLM itself, the current running and execution environment, i.e., the system environment data, such as system hardware and software, language environment, and running and execution environment of various commonly used computer tools such as python and golang, can be perceived. This is conducive to the subsequent calling of relevant tools to perform actions according to needs.

[0092] Optionally, the determining of the current environment information based on the third environment data comprises:

[0093] Performing data digest processing on the network environment data and the system environment data to obtain fourth environment data; processing the fourth environment data by using the Prompt technology in the target large language model to obtain fifth environment data; and performing formatting processing on the fifth environment data to obtain the current environment information.

[0094] In actual execution, the LLM further combs and summarizes the perceived network environment data and the system environment data, that is, the network environment data and the system environment data are summarized and generalized using the LLM. Specifically, the network environment data and the system environment data are processed using the Prompt technology in the Prompt mode of a specific LLM, where the Prompt technology is a treatment process that the LLM can better recognize and understand. After the Prompt processing, the design, coding and implementation of interaction with the LLM as the core are constructed, and the execution result is formatted, for example, the json format treatment can be used, and the vulnerability identification engine can be obtained.

[0095] The network security teaching method provided by the embodiment of the application can provide an opportunity and a place for observing automatic network attack and defense, can inspire scholars to think, and can improve learning efficiency. In addition, the large language model in the application can automatically identify security vulnerabilities in the system in combination with the network security knowledge base, can assist non-expert users in identifying vulnerabilities, and can successfully obtain the flag, thereby improving the user's network security awareness. Further, the application can help users evaluate the security risks of the system through simulated attacks and take measures for prevention.

[0096] The network security teaching method provided by the embodiment of the application can also provide an experimental platform for network security researchers to test and develop new security technologies and methods. And it can ensure that all operations are carried out within the legal and ethical framework, so that users can learn and practice in a compliant environment. Improve the robustness of the system, stimulate innovation. In addition, by continuously testing and optimizing, it helps to improve the robustness of the system and the ability to resist attacks. Further, it can also stimulate new network security ideas and solutions, and promote technological innovation.

[0097] As Figure 3 shown, the embodiment of the present application provides a network security teaching device, the device comprises:

[0098] The acquisition module 11 is configured to acquire a task index of a current network attack and defense teaching demonstration and current environment information, the task index comprises a total target, a node target, and an evaluation index corresponding to the node target, and the current environment information comprises network environment information and system environment information;

[0099] The generation module 12 is configured to input the task index and the current environment information into the target processing engine, call a target large language model by using the target processing engine, and generate a corresponding attack strategy based on the target large language model according to the task index and the current environment information, the target large language model is a large language model enhanced by using a network security knowledge base;

[0100] The execution module 13 is configured to execute the attack strategy by using the target processing engine, and acquire a corresponding execution result;

[0101] The update module 14 is configured to call the target large language model by using the target processing engine, so that the target large language model updates the attack strategy according to the execution result and the task index, until the task index is completed according to the current updated attack strategy.

[0102] In one embodiment, the attack strategy comprises a plurality of attack modes and a processing tool corresponding to each attack mode, and the execution module 13 is specifically configured to execute a corresponding attack mode by using the target processing engine to call the processing tool.

[0103] In one embodiment, the device further comprises a processing module 15, and the processing module 15 is configured to:

[0104] Acquire network security information, the network security information comprises a plurality of types of network security files, network security competition information, CTF competition information, and network vulnerability information;

[0105] If the network security information comprises media type information, the media type information is converted into text information to obtain a first data set after processing of the network security information;

[0106] The first data set is preprocessed to obtain a second data set, and the preprocessing comprises, in sequence, cleaning processing, formatting processing, deduplication processing, and standardization processing;

[0107] The second data set is encoded based on an Embedding model to generate the network security knowledge base.

[0108] In one embodiment, the processing module 15 is specifically configured to:

[0109] perform word segmentation processing on the second data set to obtain a third data set;

[0110] after determining the entity, the relationship and the description content in the third data set, perform information abstract processing on the description content in the third data set to obtain a fourth data set;

[0111] perform encoding processing on the fourth data set by using Graph Embedding to obtain a fifth data set;

[0112] perform encoding processing on the fourth data set by using Vector Embedding to obtain a sixth data set;

[0113] store the fifth data set and the sixth data set according to a corresponding relationship to obtain the network security knowledge base.

[0114] In one embodiment, the processing module 15 is further configured to:

[0115] obtain first environment data in a CTF competition based on an execution device, the first environment data including code information, system logs and network traffic, the execution device having a function of network attack and defense manipulation restoration;

[0116] perform preprocessing on the first environment data to obtain second environment data, the preprocessing including cleaning processing, formatting processing and standardization processing in sequence;

[0117] determine the current environment information based on the second environment data.

[0118] In one embodiment, the processing module 15 is specifically configured to:

[0119] call the target large language model to recognize the second environment data to obtain third environment data, the third environment data including network environment data and system environment data, the network environment data including network topology relationship and intranet network relationship, and the system environment data including system software and hardware, system language and execution environment;

[0120] determine the current environment information based on the third environment data.

[0121] In one embodiment, the processing module 15 is specifically configured to:

[0122] perform data abstract processing on the network environment data and the system environment data to obtain fourth environment data;

[0123] The fourth environment data is processed by using a Prompt technology in the target large language model to obtain fifth environment data.

[0124] The fifth environment data is formatted to obtain the current environment information.

[0125] The network security teaching device provided in the embodiment can execute the network security teaching method described above, and has similar implementation principles and technical effects, which will not be described again.

[0126] The specific limitations of the network security teaching device can be referred to the limitations of the network security teaching method described above, which will not be described again. The modules in the network security teaching device described above can be realized by software, hardware, and combinations thereof, in whole or in part. The modules described above can be embedded in or independent of the processor of the electronic device in hardware form, or can be stored in the memory of the electronic device in software form, so as to be called and executed by the processor to perform the operations corresponding to the modules.

[0127] The execution subject of the network security teaching method provided in the embodiment can be an electronic device, which can be a computer device, a terminal device, a server, or a server cluster, which is not limited in the embodiment.

[0128] Figure 4 An internal structure diagram of an electronic device provided in the embodiment is shown in FIG. Figure 4 As shown in the figure, the electronic device includes a processor and a memory connected by a system bus. The processor is used to provide calculation and control capabilities. The memory can include a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The computer program can be executed by the processor to implement the steps of the network security teaching method provided in the above embodiments. The internal memory provides a cache running environment for the operating system and the computer program in the non-volatile storage medium.

[0129] Those skilled in the art can understand that Figure 4 The internal structure diagram of the electronic device is shown in FIG.

[0130] In another embodiment of the application, a computer readable storage medium is also provided, which stores a computer program. The computer program is executed by the processor to implement the steps of the network security teaching method according to the embodiments of the application.

[0131] In another embodiment of the present application, a computer program product is provided, which includes computer instructions for implementing each step of the network security teaching method in the method flow shown in the above method embodiments.

[0132] In the above embodiments, the implementation can be achieved by software, hardware, firmware or any combination thereof, in whole or in part. When implemented by software, the implementation can be in the form of a computer program product, in whole or in part. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the computer instructions implement the flow or function according to the embodiments of the present application, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or data storage device including one or more servers, data centers, etc. integrated with the medium. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0133] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not contradict, they should be considered as the scope of the present disclosure.

[0134] The above embodiments only express several implementation manners of the present application, and the description is specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent of the present application should be subject to the appended claims.

Claims

1. A cybersecurity teaching method, characterized in that, The method includes: The task indicators and current environment information of the current network attack and defense teaching demonstration are obtained. The task indicators include the overall goal, the node goals and the evaluation indicators corresponding to the node goals. The current environment information includes network environment information and system environment information. The task indicators and the current environment information are input into the target processing engine. The target processing engine calls the target large language model and generates a corresponding attack strategy based on the target large language model according to the task indicators and the current environment information. The target large language model is a large language model enhanced with network security knowledge base. The target processing engine executes the attack strategy and obtains the corresponding execution results; The target processing engine calls the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicators until the task indicators are completed according to the current updated attack strategy. Before obtaining the task indicators of the current network attack and defense teaching demonstration, the method further includes: Obtain cybersecurity information, which includes multiple types of cybersecurity files, cybersecurity competition information, CTF competition information, and network vulnerability information; If the network security information includes media information, then the media information is converted into text information to obtain the first dataset after the network security information is processed. The first dataset is preprocessed to obtain the second dataset. The preprocessing includes cleaning, formatting, deduplication, and standardization. The second dataset is encoded using the Embedding model to generate the cybersecurity knowledge base.

2. The method according to claim 1, characterized in that, The attack strategy includes: multiple attack methods and processing tools corresponding to each attack method; The execution of the attack strategy using the target processing engine includes: using the target processing engine to call the processing tool to execute the corresponding attack method.

3. The method according to claim 1, characterized in that, The process of encoding the second dataset based on the Embedding model to generate the cybersecurity knowledge base includes: The second dataset is segmented to obtain the third dataset; After determining the entities, relationships, and descriptions in the third dataset, information digest processing is performed on the descriptions in the third dataset to obtain the fourth dataset; The fourth dataset is encoded using Graph Embedding to obtain the fifth dataset. The fourth dataset is encoded using Vector Embedding to obtain the sixth dataset; The fifth dataset and the sixth dataset are stored according to their correspondence to obtain the network security knowledge base.

4. The method according to claim 1, characterized in that, Before obtaining the task indicators of the current network attack and defense teaching demonstration, the method further includes: Acquire first environment data in a CTF competition based on an execution device. The first environment data includes code information, system logs, and network traffic. The execution device has the function of reconstructing network attack and defense operations. The first environmental data is preprocessed to obtain the second environmental data. The preprocessing includes cleaning, formatting and standardization in sequence. The current environmental information is determined based on the second environmental data.

5. The method according to claim 4, characterized in that, Determining the current environmental information based on the second environmental data includes: The target large language model is invoked to identify the second environment data to obtain the third environment data. The third environment data includes network environment data and system environment data. The network environment data includes network topology and intranet network relationships. The system environment data includes system hardware and software, system language and execution environment. The current environmental information is determined based on the third environmental data.

6. The method according to claim 5, characterized in that, Determining the current environmental information based on the third environmental data includes: Data digest processing is performed on the network environment data and the system environment data to obtain fourth environment data; The fourth environment data is processed using the Prompt technique in the target large language model to obtain the fifth environment data; The fifth environmental data is formatted to obtain the current environmental information.

7. A network security teaching device, characterized in that, The device includes: The acquisition module is used to acquire the task indicators and current environment information of the current network attack and defense teaching demonstration. The task indicators include the overall goal, the node goals, and the evaluation indicators corresponding to the node goals. The current environment information includes network environment information and system environment information. The generation module is used to input the task indicators and the current environment information into the target processing engine, use the target processing engine to call the target large language model, and generate a corresponding attack strategy based on the target large language model according to the task indicators and the current environment information. The target large language model is a large language model enhanced by the network security knowledge base. An execution module is used by the target processing engine to execute the attack strategy and obtain the corresponding execution results; The update module is used by the target processing engine to call the target large language model so that the target large language model updates the attack strategy according to the execution result and the task indicators until the task indicators are completed according to the current updated attack strategy; The device further includes: a processing module, used for: The process involves acquiring cybersecurity information, including various types of cybersecurity files, cybersecurity competition information, CTF competition information, and network vulnerability information. If the cybersecurity information includes media information, it is converted into text information to obtain a first dataset after processing the cybersecurity information. The first dataset is then preprocessed to obtain a second dataset, the preprocessing including cleaning, formatting, deduplication, and standardization. The second dataset is then encoded based on an embedding model to generate the cybersecurity knowledge base.

8. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the network security teaching method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the network security teaching method according to any one of claims 1 to 6.

Images