Multi-step attack technology link extraction method and system based on large language model and medium

Abstract

The invention discloses a multi-step attack technology link extraction method and system based on a large language model, and a medium. The method comprises the following steps: acquiring open source threat intelligence; performing data analysis and data cleaning on the open source threat intelligence in various formats, and unifying the open source threat intelligence into a plain text format; de-noising open source threat intelligence in a text format by using a large language model, and segmenting a result into single complete attack processes; the method comprises the following steps of: crawling MITRE ATTamp; performing fine tuning on the Bert according to the corresponding attack technology data in the CK database, finding out an attack technology related to attack process description through the fine-tuned Bert, and then querying MITRE ATTamp through the fine-tuned Bert; the CK database is used for acquiring corresponding attack technology description; on the basis of related attack technologies, attack technologies appearing in the attack process are sorted through a large language model and output in a structured mode. According to the invention, the efficiency and reliability of link extraction of the attack technology can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security threat intelligence analysis, and in particular to a multi-step attack technology link extraction method, system and medium based on a large language model. Background Art

[0002] In the Internet era, cyber attacks are becoming more and more severe, and the forms of cyber attacks are gradually developing in the direction of complexity, persistence and organization. In order to cope with the rapidly changing network security environment, in addition to using traditional security defense methods such as intrusion detection (IDS) and intrusion prevention (IPS), we also need to conduct data analysis on APT organizations and their common methods based on threat intelligence, so as to strengthen each stage of network defense in a targeted manner.

[0003] Threat intelligence can be divided into structured intelligence and unstructured intelligence. Structured intelligence is usually provided by major vendors and is often in the form of IOC indicators. Although structured intelligence can well indicate threat points, the granularity is often too fine; unstructured intelligence is usually obtained by network security practitioners based on attack events, and is often described in text as a whole. It not only includes important IOC indicators involved in the attack, but also includes the attack organization's technology, tactics, and execution details (tactics, techniques, procedures of attack) and other information.

[0004] Existing technologies extract attack techniques from attack process descriptions as text classification tasks. Fine-tune the BERT pre-trained on network security text to classify text fragments in the attack process, so as to obtain the attack techniques that each sentence may correspond to. However, isolated attack technique data is of limited use. In order to obtain the dependency relationship of attack techniques, existing work has attempted to model the dependency relationship as a classification task, manually annotate data and use various models for training, but the accuracy and generalization are not ideal. Only by accurately understanding the attack description can the dependency relationship between attack techniques be accurately analyzed. Summary of the invention

[0005] The main purpose of the present invention is to propose a multi-step attack technology link extraction method, system and medium based on a large language model, aiming to improve the efficiency and reliability of attack technology link extraction.

[0006] To achieve the above object, the present invention provides a multi-step attack technology link extraction method based on a large language model, the method comprising the following steps: Step S10, obtaining open source threat intelligence, where the open source threat intelligence includes at least one complete attack description; Step S20, coarse-grained preprocessing: performing data analysis and data cleaning on various formats of open source threat intelligence and unifying them into a plain text format; Step S30, fine-grained preprocessing: using a large language model to denoise the open source threat intelligence in text format, and dividing the result into a single complete attack process; Step S40, attack technology pre-classification: crawl the corresponding attack technology data in the MITRE ATT&CK database to fine-tune Bert, find out the attack technology related to the attack process description through the fine-tuned BERT, and then query the MITRE ATT&CK database through the fine-tuned BERT to obtain the corresponding attack technology description, and provide it to step S50; Step S50, generating an attack technology chain: based on relevant attack technologies, the attack technologies appearing in the attack process are sorted through a large language model and output in a structured manner.

[0007] A further technical solution of the present invention is that step S20 comprises: Step S201, using a parser to extract useful information from open source threat intelligence; Step S202, preliminarily filter out useless data based on regular expressions and save them in a unified txt format.

[0008] A further technical solution of the present invention is that, in step S201, for open source threat intelligence in HTML file format, the file abnormality is first processed, and then BeautifulSoup is used for preliminary parsing, and the get_text method is used to obtain the text part; for open source threat intelligence in PDF file format, the fitz library is used to extract the text content.

[0009] A further technical solution of the present invention is that step S202 comprises: Sample regular expressions to remove a large number of blank lines and spaces, the regular expressions are (?:\n\s*){2,} and [ \t]+$ . The regular expression (?:\n\s*){2,} matches a combination of two or more newline characters and whitespace characters, which is used to remove a large number of blank lines. Among them, (?:) is a non-capturing group, which allows us to group patterns without creating capturing groups. \n matches a newline character. \s* matches zero or more whitespace characters (including spaces, tabs, newlines, etc.). {2,} is a quantifier, which specifies that the preceding pattern must match at least 2 times. The regular expression [ \t]+$ matches spaces and tabs at the end of a string, which is used to remove spaces and tabs at the end of a line. Among them, [ \t] is a character class that matches spaces and tabs. + is a quantifier, which specifies that the preceding pattern must match one or more times. $ is an anchor, which specifies that the pattern must match the end of the string.

[0010] A further technical solution of the present invention is that step S30 comprises: Step S301, judging whether there is a complete attack process through the large language model, if so, executing step S302; Step S302, retell the multiple complete attack processes described therein in paragraphs, use the original sentences as much as possible, retain the attack implementation details in the original text as much as possible at a granularity that can be reproduced by security auditors, and provide a brief summary at the end of each complete attack process.

[0011] A further technical solution of the present invention is that step S40 comprises: Step S401, based on the retrieval enhancement method, crawl the attack technology data related to the attack process in the MITRE ATT&CK database to fine-tune Bert, and find out the attack technology related to the attack process description through the fine-tuned BERT.

[0012] A further technical solution of the present invention is that step S401 comprises: Step S4011, crawl the attack cases corresponding to each attack technology in the MITRE ATT&CK database, and then use the attack cases corresponding to each attack technology to fine-tune Bert. The model needs to predict the attack technology type corresponding to each sentence in the attack description based on the input short sentence; Step S4012, each complete attack description is segmented using a sliding window, the window length is N words, each segmentation slides backward K words, and there are NK overlapping words between adjacent windows; Step S4013, the segmented equal-length sequences are classified using the fine-tuned BERT, and the classification result is the probability of a specific type of attack technology: a threshold value p is set, and all attack technologies with a probability greater than p are retained, so that each sequence in the complete attack description has a coarse-grained attack technology label.

[0013] A further technical solution of the present invention is that step S4011 comprises: The attack technique type corresponding to each sentence is formalized into a single classification task. A short sentence describing the attack is input, and the model outputs a probability distribution, indicating the possibility of different attack techniques. When fine-tuning Bert, the cross entropy is used to calculate the loss. The calculation formula of the cross entropy loss is as follows: , is the cross entropy loss, is the number of classification categories, is the probability distribution of the true labels, is the probability distribution of the model's prediction results.

[0014] To achieve the above objectives, the present invention also proposes a multi-step attack technology link extraction system based on a large language model, the system comprising a memory, a processor, and a multi-step attack technology link extraction program based on a large language model stored on the processor, the multi-step attack technology link extraction program based on a large language model executing the steps of the method described above when run by the processor.

[0015] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, which stores a multi-step attack technology link extraction program based on a large language model, and the multi-step attack technology link extraction program based on a large language model executes the steps of the method described above when executed by a processor.

[0016] The beneficial effects of the present invention are: The present invention uses pre-trained Bert to extract attack techniques related to the description of the attack process, and uses a large language model to summarize the attack techniques involved in the attack process and output them in sequence based on the provided attack technique description. Combined with BertBERT, the generation results of the large language model are searched for enhancement. It not only utilizes the understanding ability of the large model, but also makes it less prone to hallucinations, making the extracted multi-step attack technique chain more reliable.

[0017] 1. The present invention has the function of extracting the attack process more accurately: the present invention uses a large language model to pre-process reports containing a large amount of irrelevant content and extract a complete description of the attack process.

[0018] 2. The present invention has the function of extracting attack techniques more accurately: the attack techniques extracted by traditional fine-tuning of Bert may have duplication and false positives. The present invention inputs the attack technique description extracted by Bert into a large language model, allowing the model to confirm whether the corresponding attack process corresponds to the attack technique description, thereby reducing false positives.

[0019] 3. The present invention has the ability to more accurately extract the dependencies between attack techniques: the present invention uses the understanding ability of a large language model to understand the attack process, and then outputs the attack technology chain in the order in which the attack techniques occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0021] Figure 1 It is a flow chart of a preferred embodiment of the multi-step attack technology link extraction method based on a large language model of the present invention; Figure 2 It is a hardware architecture diagram of the multi-step attack technology link extraction system based on a large language model of the present invention.

[0022] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] The present invention proposes a multi-step attack technology link extraction method based on a large language model. The technical solution adopted by the present invention mainly utilizes the understanding and powerful analysis and summary capabilities of the pre-trained large language model on network security attack and defense knowledge, combined with the advantages of BERT in the classification of small sample fine-tuning sentences, to enhance the retrieval of the generation of the pre-trained large model, thereby improving the efficiency and reliability of attack technology link extraction. This method is mainly aimed at the field of network security threat intelligence, has high scalability, and the actual effect will become better and better with the performance improvement of the large language model and the accumulation of data in the field.

[0025] This method and system are mainly used in the field of security threat intelligence analysis. By extracting specific attack links from unstructured threat intelligence (APT reports, etc.), a structured summary of a complete attack behavior of an APT organization is formed based on attack technology, thereby providing a data source for threat situation awareness, knowledge graph construction, threat intelligence analysis, and security intelligence automated decision-making.

[0026] Threat intelligence can be divided into structured intelligence and unstructured intelligence. Structured intelligence is usually provided by major manufacturers. These intelligences often exist in the form of IOC indicators. Although structured intelligence can well indicate threat points, the granularity is often too fine; unstructured intelligence is usually obtained by network security practitioners based on attack events. It often uses text to describe the security situation and attack methods as a whole, including not only the important IOC indicators involved in the attack, but also the attack organization's technology, tactics and execution details (tactics, techniques, procedures of attack) and other information. The present invention focuses on extracting the specific attack process in the attack report and extracting them in the form of attack technology links, which is convenient for subsequent analysis of the attack methods of APT organizations in combination with other threat intelligence. The present invention uses a large language model to understand the attack description, and then summarizes the dependencies between attack technologies.

[0027] Please refer to Figure 1 The multi-step attack technology link extraction method based on the large language model of the present invention preferably includes the following steps: Step S10, obtaining open source threat intelligence, where the open source threat intelligence includes at least one complete attack description.

[0028] In this embodiment, step S10 mainly integrates and downloads the open-source threat report data sources that are publicly available online, such as APT reports compiled and updated in real time by the open-source community on GitHub, APT organization attack analysis reports released by network security companies, etc. The data sources are diverse, and the acquisition methods are also different. The present invention mainly focuses on extracting the specific attack process in the attack report, and extracting them in the form of attack technology links, and can extract one or more attack technology links from the open-source threat intelligence. Therefore, it is hoped that the attack report contains a complete description of one or more APT attacks, rather than just an analysis of a single attack technology, vulnerability or software.

[0029] Step S20, coarse-grained preprocessing: data parsing and data cleaning are performed on various formats of open source threat intelligence, and unified into a plain text format.

[0030] The step S20 specifically includes: Step S201: Use a parser to extract useful information from open source threat intelligence.

[0031] In step S201, for open source threat intelligence in HTML file format, the file anomalies are first processed, and then BeautifulSoup is used for preliminary parsing, and the get_text method is used to obtain the text part; for open source threat intelligence in PDF file format, the fitz library is used to extract the text content.

[0032] Step S202, preliminarily filter out useless data based on regular expressions and save them in a unified txt format.

[0033] The step S202 includes: Sample regular expressions to remove a large number of blank lines and spaces, the regular expressions are (?:\n\s*){2,} and [ \t]+$ . The regular expression (?:\n\s*){2,} matches a combination of two or more newline characters and whitespace characters, which is used to remove a large number of blank lines. Among them, (?:) is a non-capturing group, which allows us to group patterns without creating capturing groups. \n matches a newline character. \s* matches zero or more whitespace characters (including spaces, tabs, newlines, etc.). {2,} is a quantifier, which specifies that the preceding pattern must match at least 2 times. The regular expression [ \t]+$ matches spaces and tabs at the end of a string, which is used to remove spaces and tabs at the end of a line. Among them, [ \t] is a character class that matches spaces and tabs. + is a quantifier, which specifies that the preceding pattern must match one or more times. $ is an anchor, which specifies that the pattern must match the end of the string.

[0034] This embodiment takes into account that most of the acquired open source threat intelligence is in HTML and PDF formats. Therefore, it is necessary to first use the corresponding parser to extract useful information, and then use regular expressions and other methods to preliminarily filter out useless data, and save them in txt format. For HTML format, there may be problems such as crawling failure, incomplete files, non-standard formats, character encoding, and containing a large amount of irrelevant javascript code. For PDF format, since the format of PDF files is flexible and the sources are diverse, it may be ppt or docx, so it is difficult to convert it into txt using a unified and reliable method.

[0035] Specifically, for HTML files, this embodiment first handles abnormal situations such as file damage and encoding errors, then uses BeautifulSoup for preliminary parsing, and uses the get_text method to obtain the text. For PDF files, due to the diverse sources, the effects of various methods are similar. This embodiment uses the fitz library to extract text content. Finally, this embodiment uniformly uses simple regular expressions to remove a large number of blank lines and spaces. The regular expressions used are (?:\n\s*){2,} and [\t]+$.

[0036] Step S30, fine-grained preprocessing: Use a large language model to denoise the open source threat intelligence in text format and divide the results into a single complete attack process.

[0037] The step S30 comprises: Step S301, determine whether there is a complete attack process through the large language model, if so, execute step S302.

[0038] Step S302, retell the multiple complete attack processes described therein in paragraphs, use the original sentences as much as possible, retain the attack implementation details in the original text as much as possible at a granularity that can be reproduced by security auditors, and provide a brief summary at the end of each complete attack process.

[0039] In order to make the threat intelligence more regular and ignore irrelevant information. This embodiment uses a large language model to denoise the report of the previous step. Let the large model only output content related to the actual attack process description and segment the attack process. Specifically, you can first let the large model determine whether there is at least one complete attack process, and then let it repeat the multiple complete attack processes described therein in paragraphs, use the original sentences as much as possible, at a granularity that can be reproduced by security auditors, keep the attack implementation details in the original text as much as possible, and provide a brief summary at the end of each complete attack process.

[0040] The design of prompt words is related to the ability of the large model itself and the effect of fine-tuning. Generally speaking, it is required to set appropriate system prompt words to help it enter the role, and at the same time, the user instructions are clear and unambiguous. Finally, people are needed to test on specific inputs, and then constantly adjust the prompt words, such as whether thought chain prompt words are needed, or whether input and output examples are needed, etc. If the large model has weak command following ability, it will not be good to ask it to do too many things at one time, or to impose too many restrictions on the format. It is best to simplify the task as much as possible and split the task into multiple stages.

[0041] Step S40, pre-classification of attack techniques: crawl the corresponding attack technique data in the MITRE ATT&CK database to fine-tune Bert, and use the fine-tuned BERT to find out the attack techniques related to the attack process description, and then use the fine-tuned BERT to query the MITRE ATT&CK database to obtain the corresponding attack technique description and provide it to step S50.

[0042] After step S30, this embodiment obtains a relatively clean and detailed description of the attack process, and can directly let the large model generate an attack technology link. However, although the pre-trained large model has rich knowledge, it can also produce hallucinations. In order to prevent the results generated by the model from producing hallucinations, this embodiment provides sufficient information in the above. However, the context length of the large model is limited. Providing too much irrelevant information will not only cause excessively high reasoning costs, but also damage the ability to follow instructions and reduce the quality of the generated results. Therefore, this embodiment uses a retrieval enhancement method to first extract the attack technology related to the attack process, and then query the MITRE ATT&CK database to obtain the corresponding attack technology description, and finally splice the attack technology description together to provide it to the context of the model.

[0043] The step S40 comprises: Step S401, based on the retrieval enhancement method, crawl the attack technology data related to the attack process in the MITRE ATT&CK database to fine-tune Bert, and find out the attack technology related to the attack process description through the fine-tuned BERT.

[0044] First, this embodiment hopes to find the corresponding attack technology in the MITRE ATT&CK database for each paragraph in the attack description. The MITRE ATT&CK database classifies a large number of known attack behaviors and summarizes them into hundreds of attack techniques (Techniques). In the MITRE ATT&CK database, each attack technique has many specific attack behavior cases (Procedure Examples), and most of the attack behavior cases are just one sentence. This embodiment crawls the attack cases corresponding to each attack technique in the MITRE ATT&CK database, and then uses it to fine-tune Bert. The model needs to predict the type of attack technology corresponding to this sentence based on the input short sentence. This embodiment formalizes it as a single classification task. A short sentence describing the attack is input, and the model outputs a probability distribution, indicating the possibility of different attack techniques.

[0045] The step S401 includes: Step S4011, crawl the attack cases corresponding to each attack technology in the MITRE ATT&CK database, and then use the attack cases corresponding to each attack technology to fine-tune Bert. The model needs to predict the attack technology type corresponding to each sentence in the attack description based on the input short sentence.

[0046] The step S4011 specifically includes: The attack technique type corresponding to each sentence is formalized into a single classification task. A short sentence describing the attack is input, and the model outputs a probability distribution, indicating the possibility of different attack techniques. When fine-tuning Bert, the cross entropy is used to calculate the loss. The calculation formula of the cross entropy loss is as follows: , in, is the cross entropy loss, is the number of classification categories, is the probability distribution of the true label (usually 0 or 1), is the probability distribution of the model's prediction results.

[0047] Step S4012, each complete attack description is segmented using a sliding window, the window length is N words, each segmentation slides backward K words, and there are NK overlapping words between adjacent windows.

[0048] Step S4013, the segmented equal-length sequences are classified using the fine-tuned BERT, and the classification result is the probability of a specific type of attack technology: a threshold value p is set, and all attack technologies with a probability greater than p are retained, so that each sequence in the complete attack description has a coarse-grained attack technology label.

[0049] Step S50, generating an attack technology chain: based on relevant attack technologies, the attack technologies appearing in the attack process are sorted through a large language model and output in a structured manner.

[0050] In step S50, this embodiment uses the attack technology description as the context, and requires the large model to sort the attack technologies that appear in the attack process according to the attack technology description in the context, reflect the sequential dependency of the attack technologies, and output them in a structured manner.

[0051] The beneficial effects of the present invention are: The present invention uses pre-trained Bert to extract attack techniques related to the description of the attack process, and uses a large language model to summarize the attack techniques involved in the attack process and output them in sequence based on the provided attack technique description. Combined with BertBERT, the generation results of the large language model are searched for enhancement. It not only utilizes the understanding ability of the large model, but also makes it less prone to hallucinations, making the extracted multi-step attack technique chain more reliable.

[0052] 1. The present invention has the function of extracting the attack process more accurately: the present invention uses a large language model to pre-process reports containing a large amount of irrelevant content and extract a complete description of the attack process.

[0053] 2. The present invention has the function of extracting attack techniques more accurately: the attack techniques extracted by traditional fine-tuning of Bert may have duplication and false positives. The present invention inputs the attack technique description extracted by Bert into a large language model, allowing the model to confirm whether the corresponding attack process corresponds to the attack technique description, thereby reducing false positives.

[0054] 3. The present invention has the ability to more accurately extract the dependencies between attack techniques: the present invention uses the understanding ability of a large language model to understand the attack process, and then outputs the attack technology chain in the order in which the attack techniques occur.

[0055] To achieve the above objectives, the present invention also proposes a multi-step attack technology link extraction system based on a large language model, such as Figure 2 As shown, the system includes a processor 1001, a CPU, a network interface 1004, a user interface 1003, a memory 1005, a communication bus 1002, and a multi-step attack technology link extraction program based on a large language model stored on the processor, wherein the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0056] Those skilled in the art will understand that Figure 2 The system structure shown in the figure does not constitute a limitation of the system, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0057] like Figure 2As shown, the memory 1005 as a computer storage medium may include an operating device, a network communication module, a user interface module, and a multi-step attack technology link extraction program based on a large language model.

[0058] exist Figure 2 In the system shown, the network interface 1004 is mainly used to connect to the network server and communicate data with the network server; the user interface 1003 is mainly used to interact with the user terminal and receive instructions input by the user; and the processor 1001 can be used to call the multi-step attack technology link extraction program based on the large language model stored in the memory 1005.

[0059] To achieve the above objectives, the present invention also proposes a computer-readable storage medium, which stores a multi-step attack technology link extraction program based on a large language model. When the multi-step attack technology link extraction program based on a large language model is executed by a processor, the steps of the method described above are executed, which will not be repeated here.

[0060] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A multi-step attack technology link extraction method based on a large language model, characterized in that: The method comprises the following steps: Step S10, obtaining open source threat intelligence, where the open source threat intelligence includes at least one complete attack description; Step S20, coarse-grained preprocessing: performing data analysis and data cleaning on various formats of open source threat intelligence and unifying them into a plain text format; Step S30, fine-grained preprocessing: using a large language model to denoise the open source threat intelligence in text format, and dividing the result into a single complete attack process; Step S40, attack technology pre-classification: crawl the corresponding attack technology data in the MITRE ATT&CK database to fine-tune Bert, find out the attack technology related to the attack process description through the fine-tuned BERT, and then query the MITRE ATT&CK database through the fine-tuned BERT to obtain the corresponding attack technology description, and provide it to step S50; Step S50, generating an attack technology chain: based on relevant attack technologies, the attack technologies appearing in the attack process are sorted through a large language model and output in a structured manner.

2. According to the multi-step attack technology link extraction method based on a large language model according to claim 1, it is characterized in that: The step S20 comprises: Step S201, using a parser to extract useful information from open source threat intelligence; Step S202, preliminarily filter out useless data based on regular expressions and save them in a unified txt format.

3. According to the multi-step attack technology link extraction method based on a large language model according to claim 2, it is characterized in that: In step S201, for open source threat intelligence in HTML file format, the file anomalies are first processed, and then BeautifulSoup is used for preliminary parsing, and the get_text method is used to obtain the text part; for open source threat intelligence in PDF file format, the fitz library is used to extract the text content.

4. According to the multi-step attack technology link extraction method based on a large language model according to claim 3, it is characterized in that: The step S202 includes: Sample regular expressions to remove a large number of blank lines and spaces, the regular expressions are (?:\n\s*){2,} and [ \t]+$; the regular expression (?:\n\s*){2,} matches a combination of two or more newline characters and whitespace characters, and is used to remove a large number of blank lines; where (?:) is a non-capturing group that allows pattern grouping but does not create a capturing group; \n matches a newline character; \s* matches zero or more whitespace characters; {2,} is a quantifier that specifies that the preceding pattern must match at least 2 times; the regular expression [ \t]+$ matches spaces and tabs at the end of a string, and is used to remove spaces and tabs at the end of a line; where [ \t] is a character class that matches spaces and tabs; + is a quantifier that specifies that the preceding pattern must match one or more times; $ is an anchor that specifies that the pattern must match the end of the string.

5. According to the multi-step attack technology link extraction method based on a large language model according to claim 1, it is characterized in that: The step S30 comprises: Step S301, judging whether there is a complete attack process through the large language model, if so, executing step S302; Step S302, retell the multiple complete attack processes described therein in paragraphs, use the original sentences as much as possible, retain the attack implementation details in the original text as much as possible at a granularity that can be reproduced by security auditors, and provide a brief summary at the end of each complete attack process.

6. The multi-step attack technology link extraction method based on a large language model according to claim 1 is characterized in that: The step S40 comprises: Step S401, based on the retrieval enhancement method, crawl the attack technology data related to the attack process in the MITRE ATT&CK database to fine-tune Bert, and find out the attack technology related to the attack process description through the fine-tuned BERT.

7. The multi-step attack technology link extraction method based on a large language model according to claim 6 is characterized in that: The step S401 includes: Step S4011, crawl the attack cases corresponding to each attack technology in the MITRE ATT&CK database, and then use the attack cases corresponding to each attack technology to fine-tune Bert. The model needs to predict the attack technology type corresponding to each sentence in the attack description based on the input short sentence; Step S4012, each complete attack description is segmented using a sliding window, the window length is N words, each segmentation slides backward K words, and there are NK overlapping words between adjacent windows; Step S4013, the segmented equal-length sequences are classified using the fine-tuned BERT, and the classification result is the probability of a specific type of attack technology: a threshold value p is set, and all attack technologies with a probability greater than p are retained, so that each sequence in the complete attack description has a coarse-grained attack technology label.

8. The multi-step attack technology link extraction method based on a large language model according to claim 7 is characterized in that: The step S4011 includes: The attack technique type corresponding to each sentence is formalized into a single classification task. A short sentence describing the attack is input, and the model outputs a probability distribution, indicating the possibility of different attack techniques. When fine-tuning Bert, the cross entropy is used to calculate the loss. The calculation formula of the cross entropy loss is as follows: ， in, is the cross entropy loss, is the number of classification categories, is the probability distribution of the true labels, is the probability distribution of the model's prediction results.

9. A multi-step attack technology link extraction system based on a large language model, characterized in that: The system includes a memory, a processor, and a large language model-based multi-step attack technology link extraction program stored on the processor. When the large language model-based multi-step attack technology link extraction program is executed by the processor, the steps of the method described in any one of claims 1 to 8 are executed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a multi-step attack technology link extraction program based on a large language model, and the multi-step attack technology link extraction program based on a large language model executes the steps of the method described in any one of claims 1 to 8 when executed by a processor.

Images