A rule generation method and system of a security protection software based on ChatGPT

Abstract

The application provides a rule generation method and system of a ChatGPT-based security protection software, and relates to the field of network security threat detection, and the specific scheme is as follows: a threat analysis report A of an effective rule generated by other security device platforms is automatically crawled, the effective rule of the threat analysis report A is used as a rule case to instruct the fine tuning of ChatGPT, and a sample fine-tuned GPT model is generated; a threat analysis report B of a security device to be protected is acquired, a request is initiated to ChatGPT based on the sample fine-tuned GPT model, ChatGPT generates a threat detection rule according to the request by analyzing the threat analysis report B, and the threat detection rule is converted into a syntax rule of a security protection software; simulation attack testing and white box testing are performed based on the syntax rule, syntax rules that do not pass the testing are filtered out, and a general syntax rule of the security protection software is obtained. The application improves the problem that the prior art responds to attacks slowly, and automatically designs and generates a threat detection rule, thereby reducing the use cost.

Description

Technical Field

[0001] The present invention relates to the field of network security threat detection, and in particular to a method and system for generating rules for security protection software based on ChatGPT. Background Art

[0002] GPT (Generative Pre-trained Transformer) is a deep learning model developed by OpenAI using natural language processing (NLP) technology to understand and generate human language. It can process large amounts of data and learn the complex patterns and structures of language from it.

[0003] In the field of network security, threat detection rules are a set of well-defined conditions or patterns used to identify potential security threats and malicious activities. They are based on the analysis and understanding of known attack behaviors, malware characteristics, abnormal network traffic patterns, etc., and are designed to automatically monitor and analyze data to quickly discover and respond to security incidents. Threat detection rules can be applied to a variety of security devices and solutions, including intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management (SIEM) systems, and endpoint detection and response (EDR) tools.

[0004] Most existing technologies analyze known attack methods of security personnel, extract features, and then write security rules to detect attacks. The problems with existing technical solutions are: first, they require rapid response. Currently, the risks of network security issues are severe, and a large number of attack methods are disclosed every day. Security personnel need to extract rules in a timely manner, otherwise known threats will be quickly exploited by attackers, causing losses. Second, this method requires a lot of manpower and has high requirements on the capabilities of security personnel themselves. When designing rules, they need to be able to analyze key features, and the rule syntax of different security devices is different, such as YARA rules for malware and Snort rules for traffic. When designing rules, they must consider whether false positives or false negatives will be generated, which is costly.

[0005] Therefore, it is urgent to develop a solution to solve the above problems. Summary of the Invention

[0006] The purpose of the present invention is to provide a rule generation method and system for security protection software based on ChatGPT, which improves the problem of slow response to the attacker's attack mode in the existing technology, and automatically designs and generates threat detection rules, thereby freeing up a large amount of human resources and reducing usage costs.

[0007] The present invention provides a ChatGPT-based security protection software rule generation method and system, which adopts the following technical solutions:

[0008] In the first aspect, a rule generation method for security protection software based on ChatGPT specifically includes:

[0009] Automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, use the valid rules of the threat analysis report A as rule cases to fine-tune ChatGPT instructions, and generate a sample fine-tuned GPT model;

[0010] Obtain a threat analysis report B for the security device to be protected, fine-tune the GPT model based on the sample, and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules for the security protection software.

[0011] Based on the grammatical rules, simulated attack tests and white box tests are performed to filter out grammatical rules that fail the test and obtain universal grammatical rules for security protection software.

[0012] The beneficial effects of the ChatGPT-based security protection software rule generation method provided by the present invention are:

[0013] ChatGPT is used to parse the content of threat analysis reports and generate detection rules for corresponding threats, which can be converted into the rule syntax of the corresponding security protection device detection engine. Through this method, ChatGPT can be used to automatically extract detection rules from threat analysis reports, and there is no need for security personnel to learn rule writing syntax, etc., which greatly reduces the time for rule writing, improves the timeliness of response, and reduces labor costs. At the same time, the model fine-tuning method is used to improve the accuracy and effectiveness of ChatGPT in threat rule generation tasks, improve ChatGPT's understanding of tasks, and introduce the generation of sample fine-tuning GPT models through instruction fine-tuning, so that ChatGPT can generate higher-quality threat detection rules more accurately and efficiently.

[0014] Optionally, using the effective rules of the threat analysis report A as rule cases to fine-tune ChatGPT instructions, including:

[0015] Preprocess the effective rules of the threat analysis report A and upload them to the OpenAI platform;

[0016] Set the learning rate, batch size, and maximum number of training rounds during training for fine-tuning training;

[0017] Fine-tuning training ends until the maximum number of training rounds is reached, and a sample fine-tuned GPT model is obtained.

[0018] Optionally, when ChatGPT parses threat analysis report B according to the request to generate threat detection rules, it includes:

[0019] Analyze the threat analysis report B based on a predefined prompt template;

[0020] Specific threat indicators and attacker tactics, techniques, and procedures are extracted from them, and corresponding threat detection rules are generated.

[0021] Optionally, converting the threat detection rules into grammatical rules of security protection software includes:

[0022] Obtain the syntax paradigm of threat detection rules and security protection software;

[0023] Determine whether the threat detection rule conforms to the grammatical specification by comparing it with the grammatical paradigm of the security protection software; if it does not conform to the grammatical specification, modify the grammatical rule of the security protection software based on the grammatical paradigm;

[0024] Analyze whether the grammatical rules of the security protection software have defects. If defects are found, supplement the rules and store them in the rule detection library.

[0025] Optionally, before being stored in the rule detection library, the grammatical rules of the security protection software are marked as undetected.

[0026] Optionally, performing simulated attack testing and white box testing based on the grammatical rules includes:

[0027] Acquire grammatical rules marked as undetected from the detection rule library;

[0028] A virtual environment is built to simulate attacks. Undetected grammatical rules are used to detect whether the simulated attack is hit. If the grammatical rules are not hit, the test fails. Otherwise, the test passes.

[0029] Build a white box test environment and use untested grammatical rules to detect whether false positives will occur. Grammar rules with false positives will fail the test, otherwise they will pass.

[0030] Optionally, the threat detection report includes the attacker's tactics, techniques and procedures, the attack tools used, the target system of the attack, the potential consequences of the attack means and defense suggestions.

[0031] Optionally, the grammatical rules of the security protection software include: YARA rules, Snort rules and Suricata rules.

[0032] The second aspect is a rule generation system for security protection software based on ChatGPT, specifically including:

[0033] The model fine-tuning module is used to automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, and use the valid rules of the threat analysis report A as rule cases to fine-tune the instructions of ChatGPT to generate a sample fine-tuned GPT model;

[0034] A rule conversion module is used to obtain a threat analysis report B of the security device to be protected, fine-tune the GPT model based on the sample, and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules of the security protection software;

[0035] The test screening module performs simulated attack testing and white box testing based on the grammatical rules, screens out grammatical rules that fail the test, and obtains the general grammatical rules of the security protection software.

[0036] The beneficial effects of the second aspect can refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart of the overall steps of a rule generation method for security protection software based on ChatGPT;

[0038] Figure 2 This is a flowchart of the test steps for a rule generation method for security protection software based on ChatGPT. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0040] Glossary:

[0041] 1. Threat detection rules are standards or patterns used to identify potentially malicious behavior within a network or system. These rules are a core component of security monitoring and threat detection tools, used to automatically search for anomalous behavior or known attack indicators within log files, network traffic, or other security-related data. By defining specific rules to match these data points and behavioral patterns, threat detection systems can quickly identify potential security threats during real-time monitoring, triggering alerts or automated response mechanisms to prevent or mitigate the impact of security incidents.

[0042] 2. A threat analysis report is a detailed document that provides an in-depth analysis of a specific security threat, malware, attack campaign, or security incident. These reports are typically produced by security researchers or security companies and are intended to provide a comprehensive understanding of the threat, including the attacker's tactics, techniques, and procedures (TTPs), the tools used, the affected systems, the potential consequences, and defense recommendations.

[0043] See also Figure 1 The embodiment of the present invention provides a method for generating rules for security protection software based on ChatGPT, comprising the following steps:

[0044] S1. Automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, use the valid rules of the threat analysis report A as rule cases to fine-tune ChatGPT instructions, and generate a sample fine-tuned GPT model;

[0045] S2. Obtain a threat analysis report B for the security device to be protected, fine-tune the GPT model based on the sample, and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules for the security protection software.

[0046] S3. Perform simulated attack testing and white box testing based on the grammatical rules, filter out grammatical rules that fail the test, and obtain general grammatical rules for the security protection software.

[0047] In some embodiments, when executing step S1, the effective rules of the threat analysis report A are used as rule cases to fine-tune the instructions of ChatGPT, including:

[0048] Preprocess the effective rules of the threat analysis report A and upload them to the OpenAI platform;

[0049] Set the learning rate, batch size, and maximum number of training rounds during training for fine-tuning training;

[0050] Fine-tuning training ends until the maximum number of training rounds is reached, and a sample fine-tuned GPT model is obtained.

[0051] Furthermore, the threat analysis report A is derived from other security device platforms that have generated effective rules;

[0052] Specifically, when preprocessing the effective rules of the threat analysis report A and uploading them to the OpenAI platform, the effective rules are cleaned and organized, and redundant and irrelevant information is removed to obtain training data. The preprocessed training data is uploaded to ensure that the data format is correct and meets the requirements of the OpenAI platform.

[0053] In fact, during the fine-tuning process, the fine-tuning progress and performance are monitored through the interface provided by the OpenAI platform, and the fine-tuning model is evaluated using the validation dataset to check its performance and accuracy. According to the evaluation results, the fine-tuning parameters or training data are adjusted in time to improve the performance of the sample fine-tuning GPT model.

[0054] In some embodiments, when executing step S2, it includes:

[0055] S2-1. Obtain threat analysis report B for the security device to be protected;

[0056] S2-2. Fine-tune the GPT model based on the sample and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request and generates threat detection rules.

[0057] S2-3. Convert the threat detection rules into grammatical rules of security protection software.

[0058] Specifically, when executing step S2-1, a threat analysis report B of the security device to be protected is obtained, and the threat detection report includes the attacker's tactics, techniques and procedures, the attack tools used, the target system of the attack, the potential consequences of the attack means and defense suggestions.

[0059] Furthermore, a threat analysis report is a detailed document that provides an in-depth analysis of a specific security threat, malware, attack campaign, or security incident, typically produced by security researchers or security companies to provide a comprehensive understanding of the threat.

[0060] Specifically, when executing step S2-2, ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, including:

[0061] Analyze the threat analysis report B based on a predefined prompt template;

[0062] Specific threat indicators and attacker tactics, techniques, and procedures are extracted from them, and corresponding threat detection rules are generated.

[0063] Specifically, in step S2-3, the threat detection rules are converted into grammatical rules of security protection software, including:

[0064] S2-3-1. Obtain the syntax of threat detection rules and security protection software;

[0065] S2-3-2. Determine whether the threat detection rules conform to the syntax specification by comparing them with the syntax paradigm of the security protection software. If not, modify the syntax rules of the security protection software based on the syntax paradigm;

[0066] S2-3-3. Analyze whether there are defects in the grammatical rules of the security protection software. If there are defects, supplement the rules and store them in the rule detection library.

[0067] Furthermore, the grammatical rules of the security protection software include: YARA rules, Snort rules and Suricata rules.

[0068] Furthermore, before being stored in the rule detection library, the grammatical rules of the security protection software are marked as undetected.

[0069] In fact, if the security protection software is malware detection, it can be converted into corresponding YARA rules; if the security protection software is Snort or Suricata, it will also be converted into the corresponding rule syntax.

[0070] In other embodiments, for example, based on the threat intelligence in the threat report that "a webshell is uploaded to the tomcat application of the Linux server and the "whoami" command is executed", the corresponding grammatical rule converted by ChatGPT is "check whether the command line of the parent process contains the "tomcat" string". At this time, the file path of the child process is " / whoami", but based on the sample fine-tuning of the understanding ability of the GPT model, another possible tomcat application parent process detection is added for the path " / bin / java", and common command rules used for penetration that are not executed by common website applications.

[0071] In some embodiments, when executing step S3, it includes:

[0072] S3-1, performing simulated attack testing and white box testing based on the grammatical rules;

[0073] S3-2. Filter out the grammatical rules that fail the test and obtain the general grammatical rules of the security protection software.

[0074] Specifically, when executing step S3-1, performing simulated attack testing and white box testing based on the grammatical rules, the following steps are included:

[0075] S3-1-1. Acquire grammatical rules marked as undetected from the detection rule library;

[0076] S3-1-2. Build a virtual environment to simulate an attack. Use the untested grammatical rules to check whether the simulated attack is hit. If the grammatical rules are not hit, the test fails. Otherwise, the test passes.

[0077] S3-1-3. Build a white box test environment and use untested grammatical rules to detect whether false positives will occur. Grammar rules with false positives will fail the test, otherwise they will pass.

[0078] In fact, see Figure 2 , obtain the generated rules from the detection rule library, and test whether they hit the target through the attack test simulated according to the threat analysis report. If they hit the target, it means they are effective. Then, perform a white environment test (white box test) on a server with a large number of commonly used applications installed to detect whether false alarms will be generated due to normal business. In this way, high-quality and effective grammatical rules can be screened out.

[0079] Specifically, when executing step S3-2, failing the test means failing either the simulated attack test or the white box test.

[0080] The embodiment of the present invention further provides a rule generation system for security protection software based on ChatGPT, specifically comprising:

[0081] The model fine-tuning module is used to automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, and use the valid rules of the threat analysis report A as rule cases to fine-tune the instructions of ChatGPT to generate a sample fine-tuned GPT model;

[0082] A rule conversion module is used to obtain a threat analysis report B of the security device to be protected, fine-tune the GPT model based on the sample, and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules of the security protection software;

[0083] The test screening module performs simulated attack testing and white box testing based on the grammatical rules, screens out grammatical rules that fail the test, and obtains the general grammatical rules of the security protection software.

[0084] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A rule generation method for security protection software based on ChatGPT, characterized in that: include: Automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, use the valid rules of the threat analysis report A as rule cases to fine-tune ChatGPT instructions, and generate a sample fine-tuned GPT model; Obtain a threat analysis report B for the security device to be protected, fine-tune the GPT model based on the sample, and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules for the security protection software. Based on the grammatical rules, simulated attack tests and white box tests are performed to filter out grammatical rules that fail the test and obtain universal grammatical rules for security protection software.

2. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: Using the effective rules of the threat analysis report A as rule cases, fine-tune the instructions of ChatGPT, including: Preprocess the effective rules of the threat analysis report A and upload them to the OpenAI platform; Set the learning rate, batch size, and maximum number of training rounds during training for fine-tuning training; Fine-tuning training ends until the maximum number of training rounds is reached, and a sample fine-tuned GPT model is obtained.

3. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: When ChatGPT parses threat analysis report B based on the request and generates threat detection rules, it includes: Analyze the threat analysis report B based on a predefined prompt template; Specific threat indicators and attacker tactics, techniques, and procedures are extracted from them, and corresponding threat detection rules are generated.

4. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: Converting the threat detection rules into grammatical rules of security protection software includes: Obtain the syntax paradigm of threat detection rules and security protection software; Determine whether the threat detection rule conforms to the grammatical specification by comparing it with the grammatical paradigm of the security protection software; if it does not conform to the grammatical specification, modify the grammatical rules of the security protection software based on the grammatical paradigm; Analyze whether the grammatical rules of the security protection software have defects. If defects are found, supplement the rules and store them in the rule detection library.

5. The rule generation method for ChatGPT-based security protection software according to claim 4, characterized in that: Before storing in the rule detection library, the grammatical rules of the security protection software are marked as undetected.

6. The rule generation method for ChatGPT-based security protection software according to claim 5, characterized in that: When conducting simulated attack tests and white box tests based on the grammatical rules, the following are included: Acquire grammatical rules marked as undetected from the detection rule library; A virtual environment is built to simulate attacks. Undetected grammatical rules are used to detect whether the simulated attack is hit. If the grammatical rules are not hit, the test fails. Otherwise, the test passes. Build a white box test environment and use untested grammatical rules to detect whether false positives will occur. Grammar rules with false positives will fail the test, otherwise they will pass.

7. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: The threat analysis report includes the attacker's tactics, techniques and procedures, the attack tools used, the target system of the attack, the potential consequences of the attack means and defense recommendations.

8. The rule generation method for ChatGPT-based security protection software according to claim 1, characterized in that: The grammatical rules of the security protection software include: YARA rules, Snort rules and Suricata rules.

9. A rule generation system for security protection software based on ChatGPT, characterized in that: include: The model fine-tuning module is used to automatically crawl threat analysis reports A that have generated valid rules from other security device platforms, and use the valid rules of the threat analysis report A as rule cases to fine-tune the instructions of ChatGPT to generate a sample fine-tuned GPT model; A rule conversion module is used to obtain a threat analysis report B of the security device to be protected, fine-tune the GPT model based on the sample, and initiate a request to ChatGPT. ChatGPT parses the threat analysis report B according to the request to generate threat detection rules, and converts the threat detection rules into grammatical rules of the security protection software; The test screening module performs simulated attack testing and white box testing based on the grammatical rules, screens out grammatical rules that fail the test, and obtains the general grammatical rules of the security protection software.

Images