ChatGPT-based security protection software rule generation method and system

Abstract

The invention provides a ChatGPT-based security protection software rule generation method and system, and relates to the field of network security threat detection, and the specific scheme is as follows: automatically crawling a threat analysis report A of an effective rule generated by other security equipment platforms, taking the effective rule of the threat analysis report A as a rule case to carry out instruction fine tuning on ChatGPT, and taking the effective rule of the ChatGPT as a rule case; generating and obtaining a sample fine tuning GPT model; obtaining a threat analysis report B of the security equipment to be protected, initiating a request for ChatGPT based on the sample fine tuning GPT model, analyzing the threat analysis report B by ChatGPT according to the request to generate a threat detection rule, and converting the threat detection rule into a grammar rule of security protection software; and performing simulation attack test and white-box test based on the grammar rules, and screening out grammar rules which do not pass the test to obtain general grammar rules of the security protection software. According to the method, the problem that the attack response is slow in the prior art is solved, the threat detection rule is automatically designed and generated, and the use cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security threat detection, and in particular to a rule generation method and system for security protection software based on ChatGPT. Background Art

[0002] GPT (Generative Pre-trained Transformer) is a deep learning model developed by OpenAI using natural language processing (NLP) technology to understand and generate human language. It can process large amounts of data and learn the complex patterns and structures of language from it.

[0003] In the field of network security, threat detection rules are a set of well-defined conditions or patterns used to identify potential security threats and malicious activities. They are based on the analysis and understanding of known attack behaviors, malware characteristics, abnormal network traffic patterns, etc., and are designed to automatically monitor and analyze data to quickly discover and respond to security incidents. Threat detection rules can be applied to a variety of security devices and solutions, including intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management (SIEM) systems, and endpoint detection and response (EDR) tools.

[0004] Most of the existing technologies analyze the attack methods known to security personnel, and then extract features to write security rules, so as to detect attacks; the problems with the solutions of the existing technologies are: first, a quick response is required. At present, the risk of network security issues is severe, and a large number of attack methods are disclosed every day. Security personnel need to extract rules in time, otherwise the known threats will be quickly exploited by attackers and cause losses; second, this method requires a lot of manpower, and the security personnel themselves have high requirements for their own capabilities. When designing rules, they need to be able to analyze key features, and the rule syntax of different security devices is not the same, such as YARA rules for malware, Snort rules for traffic, etc., and when designing rules, it is necessary to consider whether false alarms or missed alarms will be generated, which is costly.

[0005] Therefore, it is urgent to develop a solution to solve the above problems. Summary of the invention

[0006] The purpose of the present invention is to provide a rule generation method and system for security protection software based on ChatGPT, which improves the problem of slow response to the attacker's attack method in the prior art, and automatically designs and generates threat detection rules, thereby freeing up a large amount of human resources and reducing the cost of use.

[0007] The present invention provides a ChatGPT-based security protection software rule generation method and system, which adopts the following technical solutions:

[0008] In the first aspect, a rule generation method for security protection software based on ChatGPT specifically includes:

[0009] Automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, use the valid rules of the threat analysis report A as rule cases to fine-tune the instructions of ChatGPT, and generate a sample fine-tuned GPT model;

[0010] Obtain a threat analysis report B of the security device to be protected, fine-tune the GPT model based on the sample, initiate a request to ChatGPT, ChatGPT parses the threat analysis report B according to the request to generate a threat detection rule, and converts the threat detection rule into a grammatical rule of the security protection software;

[0011] Based on the grammatical rules, simulated attack tests and white box tests are performed to filter out grammatical rules that fail the test and obtain general grammatical rules for security protection software.

[0012] The beneficial effects of the rule generation method for security protection software based on ChatGPT provided by the present invention are:

[0013] ChatGPT is used to parse the content of threat analysis reports and generate detection rules for corresponding threats, which can be converted into the rule syntax of the corresponding security protection device detection engine. Through this method, ChatGPT can be used to automatically extract detection rules from threat analysis reports, and security personnel do not need to learn rule writing syntax, etc., which greatly reduces the time for rule writing, improves the timeliness of response, and reduces labor costs. At the same time, the model fine-tuning method is used to improve the accuracy and effectiveness of ChatGPT in threat rule generation tasks, improve ChatGPT's understanding of tasks, and introduce the generation of sample fine-tuning GPT model through instruction fine-tuning, so that ChatGPT can generate higher-quality threat detection rules more accurately and efficiently.

[0014] Optionally, the effective rules of the threat analysis report A are used as rule cases to fine-tune the instructions of ChatGPT, including:

[0015] Preprocess the effective rules of the threat analysis report A and upload them to the OpenAI platform;

[0016] Set the learning rate, batch size, and maximum number of training rounds during training to perform fine-tuning training;

[0017] The fine-tuning training is terminated until the maximum number of training rounds is reached, and a sample fine-tuned GPT model is obtained.

[0018] Optionally, when ChatGPT generates a threat detection rule based on the request parsing threat analysis report B, it includes:

[0019] Analyze the threat analysis report B based on a predefined prompt template;

[0020] Specific threat indicators and attackers’ tactics, techniques and procedures are extracted from them, and corresponding threat detection rules are generated.

[0021] Optionally, converting the threat detection rule into a grammatical rule of security protection software includes:

[0022] Obtain the syntax paradigm of threat detection rules and security protection software;

[0023] Determine whether the threat detection rule conforms to the grammatical specification by comparing the grammatical paradigm of the security protection software, and if it does not conform to the grammatical specification, modify the grammatical rule of the security protection software based on the grammatical paradigm;

[0024] Analyze whether the grammatical rules of the security protection software have defects. If defects are found, supplement the rules and store them in the rule detection library.

[0025] Optionally, before being stored in the rule detection library, the grammatical rules of the security protection software are marked as undetected.

[0026] Optionally, when performing a simulated attack test and a white box test based on the grammatical rule, the following steps are included:

[0027] Acquire grammatical rules marked as undetected from the detection rule library;

[0028] Build a virtual environment to simulate attacks, and use the undetected grammar rules to detect whether the simulated attack is hit. If the grammar rules of the simulated attack are not hit, the test fails, otherwise it passes;

[0029] Build a white-box test environment and use the untested grammar rules to detect whether false positives will occur. The grammar rules with false positives will fail the test, otherwise they will pass.

[0030] Optionally, the threat detection report includes the attacker's tactics, techniques and procedures, the attack tools used, the target system of the attack, the potential consequences of the attack means and defense suggestions.

[0031] Optionally, the grammatical rules of the security protection software include: YARA rules, Snort rules and Suricata rules.

[0032] In the second aspect, a rule generation system for security protection software based on ChatGPT specifically includes:

[0033] The model fine-tuning module is used to automatically crawl the threat analysis report A that has generated effective rules from other security device platforms, and use the effective rules of the threat analysis report A as rule cases to fine-tune the ChatGPT instructions to generate a sample fine-tuned GPT model;

[0034] A rule conversion module is used to obtain a threat analysis report B of the security device to be protected, and to initiate a request to ChatGPT based on the sample fine-tuning GPT model. ChatGPT parses the threat analysis report B according to the request to generate a threat detection rule, and converts the threat detection rule into a grammatical rule of the security protection software;

[0035] The test screening module performs simulated attack testing and white box testing based on the grammatical rules, screens out grammatical rules that fail the test, and obtains general grammatical rules for security protection software.

[0036] The beneficial effects of the second aspect can refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flowchart of the overall steps of a rule generation method for security protection software based on ChatGPT;

[0038] Figure 2 The present invention is a flowchart of the test steps of a rule generation method for security protection software based on ChatGPT. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0040] Glossary:

[0041] 1. Threat detection rules are standards or patterns used to identify potential malicious behavior in a network or system. These rules are the core components of security monitoring and threat detection tools, and are used to automatically search for abnormal behavior or known attack indicators in log files, network traffic, or other security-related data. By defining specific rules to match these data points and behavior patterns, threat detection systems can quickly identify potential security threats in real-time monitoring, thereby initiating alerts or automatic response mechanisms to prevent or mitigate the impact of security incidents.

[0042] 2. Threat analysis reports are detailed documents that provide in-depth analysis of specific security threats, malware, attack activities, or security incidents. These reports are usually produced by security researchers and security companies to provide a comprehensive understanding of the threat, including the attacker's tactics, techniques, and procedures (TTPs), tools used, affected systems, potential consequences, and defense recommendations.

[0043] See also Figure 1 The embodiment of the present invention provides a rule generation method for security protection software based on ChatGPT, comprising the following steps:

[0044] S1. Automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, use the valid rules of the threat analysis report A as rule cases to fine-tune the instructions of ChatGPT, and generate a sample fine-tuned GPT model;

[0045] S2. Obtain the threat analysis report B of the security device to be protected, fine-tune the GPT model based on the sample, initiate a request to ChatGPT, ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules of the security protection software;

[0046] S3. Perform simulated attack tests and white box tests based on the grammatical rules, filter out grammatical rules that fail the test, and obtain general grammatical rules for security protection software.

[0047] In some embodiments, when executing step S1, the effective rules of the threat analysis report A are used as rule cases to fine-tune the instructions of ChatGPT, including:

[0048] Preprocess the effective rules of the threat analysis report A and upload them to the OpenAI platform;

[0049] Set the learning rate, batch size, and maximum number of training rounds during training to perform fine-tuning training;

[0050] The fine-tuning training is terminated until the maximum number of training rounds is reached, and a sample fine-tuned GPT model is obtained.

[0051] Furthermore, the threat analysis report A is derived from other security device platforms that have generated effective rules;

[0052] Specifically, when the effective rules of the threat analysis report A are preprocessed and uploaded to the OpenAI platform, the effective rules are cleaned and sorted, redundant and irrelevant information is removed to obtain training data, and the preprocessed training data is uploaded to ensure that the data format is correct and meets the requirements of the OpenAI platform.

[0053] In fact, during the fine-tuning process, the fine-tuning progress and performance are monitored through the interface provided by the OpenAI platform, and the fine-tuning model is evaluated using a validation dataset to check its performance and accuracy. According to the evaluation results, the fine-tuning parameters or training data are adjusted in time to improve the performance of the sample fine-tuning GPT model.

[0054] In some embodiments, when executing step S2, it includes:

[0055] S2-1. Obtain threat analysis report B of the security device to be protected;

[0056] S2-2, fine-tuning the GPT model based on the sample to initiate a request to ChatGPT, and ChatGPT parses the threat analysis report B according to the request to generate threat detection rules;

[0057] S2-3. Convert the threat detection rules into grammatical rules of security protection software.

[0058] Specifically, when executing step S2-1, a threat analysis report B of the security device to be protected is obtained, and the threat detection report includes the attacker's tactics, techniques and procedures, the attack tools used, the target system of the attack, the potential consequences of the attack means and defense suggestions.

[0059] Furthermore, a threat analysis report is a detailed document that provides an in-depth analysis of a specific security threat, malware, attack campaign, or security incident, which is usually prepared by security researchers or security companies to provide a comprehensive understanding of the threat.

[0060] Specifically, when executing step S2-2, ChatGPT generates threat detection rules according to the request parsing threat analysis report B, including:

[0061] Analyze the threat analysis report B based on a predefined prompt template;

[0062] Specific threat indicators and attackers’ tactics, techniques and procedures are extracted from them, and corresponding threat detection rules are generated.

[0063] Specifically, in executing step S2-3, the threat detection rule is converted into a grammatical rule of the security protection software, including:

[0064] S2-3-1. Obtain the syntax paradigm of threat detection rules and security protection software;

[0065] S2-3-2, judging whether the threat detection rules conform to the grammatical specification by comparing the grammatical paradigm of the security protection software, and if not, modifying the grammatical rules of the security protection software based on the grammatical paradigm;

[0066] S2-3-3. Analyze whether there are defects in the grammatical rules of the security protection software. If there are defects, supplement the rules and store them in the rule detection library.

[0067] Furthermore, the grammatical rules of the security protection software include: YARA rules, Snort rules and Suricata rules.

[0068] Furthermore, before being stored in the rule detection library, the grammatical rules of the security protection software are marked as undetected.

[0069] In fact, if the security protection software is malware detection, it can be converted into corresponding YARA rules; if the security protection software is Snort or Suricata, it will also be converted into corresponding rule syntax.

[0070] In other embodiments, for example, based on the threat intelligence in the threat report that "the webshell uploaded in the tomcat application of the Linux server executed the "whoami" command", the corresponding grammatical rule converted by ChatGPT is "check whether the command line of the parent process contains the "tomcat" string". At this time, the file path of the child process is " / whoami", but based on the sample fine-tuning of the understanding ability of the GPT model, another possible tomcat application parent process detection is added for the path " / bin / java", and command rules for common penetration that are not executed by common website applications.

[0071] In some embodiments, when executing step S3, it includes:

[0072] S3-1, performing simulated attack testing and white box testing based on the grammatical rules;

[0073] S3-2. Filter out the grammatical rules that fail the test and obtain the general grammatical rules of the security protection software.

[0074] Specifically, when executing step S3-1, performing simulated attack testing and white box testing based on the grammar rules, it includes:

[0075] S3-1-1, obtaining grammatical rules marked as undetected from the detection rule library;

[0076] S3-1-2. Build a virtual environment to simulate an attack, and use the grammatical rules in the undetected state to detect whether the simulated attack is hit. If the grammatical rules of the simulated attack are not hit, the test fails, otherwise it passes;

[0077] S3-1-3. Build a white box test environment and use the untested grammar rules to detect whether false positives will occur. The grammar rules with false positives will fail the test, otherwise they will pass.

[0078] In fact, see Figure 2 , obtain the generated rules from the detection rule library, and test whether they hit the target through the attack test simulated according to the threat analysis report. If they hit the target, it means they are effective. Then, perform a white environment test (white box test) on a server with a large number of commonly used applications installed to detect whether false alarms will be generated due to normal business. In this way, high-quality and effective grammar rules can be screened out.

[0079] Specifically, when executing step S3-2, failure to pass the test means failure to pass either the simulated attack test or the white box test.

[0080] The embodiment of the present invention also provides a rule generation system for security protection software based on ChatGPT, which specifically includes:

[0081] The model fine-tuning module is used to automatically crawl the threat analysis report A that has generated effective rules from other security device platforms, and use the effective rules of the threat analysis report A as rule cases to fine-tune the ChatGPT instructions to generate a sample fine-tuned GPT model;

[0082] A rule conversion module is used to obtain a threat analysis report B of the security device to be protected, and to initiate a request to ChatGPT based on the sample fine-tuning GPT model. ChatGPT parses the threat analysis report B according to the request to generate a threat detection rule, and converts the threat detection rule into a grammatical rule of the security protection software;

[0083] The test screening module performs simulated attack testing and white box testing based on the grammatical rules, screens out grammatical rules that fail the test, and obtains general grammatical rules for security protection software.

[0084] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A rule generation method for security protection software based on ChatGPT, characterized in that: include: Automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, use the valid rules of the threat analysis report A as rule cases to fine-tune the instructions of ChatGPT, and generate a sample fine-tuned GPT model; Obtain a threat analysis report B of the security device to be protected, fine-tune the GPT model based on the sample, initiate a request to ChatGPT, ChatGPT parses the threat analysis report B according to the request to generate a threat detection rule, and converts the threat detection rule into a grammatical rule of the security protection software; Based on the grammatical rules, simulated attack tests and white box tests are performed to filter out grammatical rules that fail the test and obtain general grammatical rules for security protection software.

2. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: The effective rules of the threat analysis report A are used as rule cases to fine-tune the instructions of ChatGPT, including: Preprocess the effective rules of the threat analysis report A and upload them to the OpenAI platform; Set the learning rate, batch size, and maximum number of training rounds during training to perform fine-tuning training; The fine-tuning training is terminated until the maximum number of training rounds is reached, and a sample fine-tuned GPT model is obtained.

3. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: When ChatGPT generates threat detection rules based on the request parsing threat analysis report B, it includes: Analyze the threat analysis report B based on a predefined prompt template; Specific threat indicators and attackers’ tactics, techniques and procedures are extracted from them, and corresponding threat detection rules are generated.

4. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: The threat detection rules are converted into grammatical rules of security protection software, including: Obtain the syntax paradigm of threat detection rules and security protection software; Determine whether the threat detection rule conforms to the grammatical specification by comparing the grammatical paradigm of the security protection software, and if it does not conform to the grammatical specification, modify the grammatical rule of the security protection software based on the grammatical paradigm; Analyze whether the grammatical rules of the security protection software have defects. If defects are found, supplement the rules and store them in the rule detection library.

5. The rule generation method for ChatGPT-based security protection software according to claim 4, characterized in that: Before storing in the rule detection library, the grammatical rules of the security protection software are marked as undetected.

6. The rule generation method for ChatGPT-based security protection software according to claim 5, characterized in that: When performing simulated attack testing and white box testing based on the grammatical rules, it includes: Acquire grammatical rules marked as undetected from the detection rule library; Build a virtual environment to simulate attacks, and use the undetected grammar rules to detect whether the simulated attack is hit. If the grammar rules of the simulated attack are not hit, the test fails, otherwise it passes; Build a white-box test environment and use the untested grammar rules to detect whether false positives will occur. The grammar rules with false positives will fail the test, otherwise they will pass.

7. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: The threat detection report includes the attacker's tactics, techniques and procedures, the attack tools used, the target system of the attack, the potential consequences of the attack method and defense recommendations.

8. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: The grammatical rules of the security protection software include: YARA rules, Snort rules and Suricata rules.

9. A rule generation system for security protection software based on ChatGPT, characterized in that: include: The model fine-tuning module is used to automatically crawl the threat analysis report A that has generated effective rules from other security device platforms, and use the effective rules of the threat analysis report A as rule cases to fine-tune the ChatGPT instructions to generate a sample fine-tuned GPT model; A rule conversion module is used to obtain a threat analysis report B of the security device to be protected, and to initiate a request to ChatGPT based on the sample fine-tuning GPT model. ChatGPT parses the threat analysis report B according to the request to generate a threat detection rule, and converts the threat detection rule into a grammatical rule of the security protection software; The test screening module performs simulated attack testing and white box testing based on the grammatical rules, screens out grammatical rules that fail the test, and obtains the general grammatical rules of the security protection software.

Images