Near-body honey spot document generation method and system based on large language model

Abstract

The invention discloses a near honey spot document generation method and system based on a large language model, and the method comprises the steps: extracting the information of all key objects from a target document, the key objects comprising key concepts and key formulas; determining a to-be-replaced target object set in the target document; generating a replacement set for replacing the target object set through a large language model; replacing the target object set in the target document according to the replacement set to generate a close honey point document; a plurality of replacement sets are repeatedly generated, and then a plurality of close honey spot documents are generated. According to the embodiment of the invention, an attacker can be effectively confused and puzzled, so that the attacker cannot easily distinguish the authenticity of the document, the security of the system is further improved, and the method can be widely applied to the technical field of computers.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and system for generating close-range honey spot documents based on a large language model. Background Art

[0002] As remote work becomes more and more common, data breaches continue to occur, and the current situation of network information security has become increasingly severe.

[0003] Honey bait technology is usually used to lure attackers to access forged sensitive information in order to detect and analyze attack behaviors. However, existing honey bait technology mainly focuses on creating false sensitive information (such as passwords, account numbers, financial data, etc.), while the protection of corporate technical documents is relatively weak. Technical documents usually contain the core knowledge and proprietary technologies of an enterprise and are an important part of the competitiveness of an enterprise. When attackers invade the internal system of an enterprise, they often steal a large number of documents. Once these documents are maliciously obtained, they may cause immeasurable losses to the enterprise. Existing honey bait documents focus on obvious sensitive information, such as personal data or financial records, while the protection of important technical documents of the enterprise is relatively insufficient. In addition, the generation of existing honey bait documents relies on manual operations or simple automated tools, which makes it difficult to quickly generate a large number of high-quality honey bait documents and cannot cope with complex and changing attack methods.

[0004] The existing honey bait technology has the following disadvantages:

[0005] 1. Most of the document contents are only focused on sensitive information, and no technical documents are involved. Existing technologies ignore the important protection object of technical documents. However, enterprise technical documents often contain the core knowledge and proprietary technology of the enterprise, which is a key component of the enterprise's competitiveness. Once these documents are obtained by attackers, it will cause serious intellectual property and competitiveness losses to the enterprise.

[0006] 2. The degree of simulation of document content is not high. Existing honey bait generation technologies usually use simple replacement algorithms or template methods when generating content. These methods cannot handle complex semantics and logical relationships, resulting in the lack of authenticity in the content and logic of the generated documents.

[0007] 3. The selection strategy of the replaced content of the document is single. The existing technology only selects the phrases with high importance in the document for replacement, which makes it easy to identify the falsity of the content.

[0008] 4. Low efficiency of document generation. Traditional honey bait generation technology has significant deficiencies in automation and intelligence, and relies on manual adjustment and setting. This not only makes the generation process time-consuming and labor-intensive, but also limits the number of honey bait documents generated, making it difficult to achieve large-scale deployment. Summary of the invention

[0009] The main purpose of the embodiments of the present invention is to propose an efficient method and system for generating close-in honeyspot documents based on a large language model, which can effectively confuse and confuse attackers, making it difficult for them to easily distinguish between the authenticity of documents, thereby improving the security of the system.

[0010] To achieve the above object, an embodiment of the present invention provides a method for generating a close-up honeyspot document based on a large language model, comprising the following steps:

[0011] Extracting information of all key objects from the target document, wherein the key objects include key concepts and key formulas;

[0012] Determining a set of target objects to be replaced in the target document;

[0013] Generate a replacement set for replacing the target object set by using a large language model;

[0014] Replace the target object set in the target document according to the replacement set to generate a close-in honeyspot document;

[0015] Repeatedly generate multiple replacement sets to generate multiple close-in honeyspot documents.

[0016] In some embodiments, extracting information of all key objects from the target document includes the following steps:

[0017] Build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas in the document collection;

[0018] Determine whether each document in the document collection is a Chinese document or an English document, and obtain a set of initial concepts in each document; for Chinese documents, use the jieba word segmentation library to extract nouns and noun phrases with a length less than or equal to 6; for English documents, use the jieba word segmentation library to extract nouns and noun phrases with a length less than or equal to 6;

[0019] By constructing prompt words, the noun phrases irrelevant to the topic in the initial concepts are eliminated through a large language model to obtain a set of candidate concepts for each document;

[0020] Use the TF-IDF algorithm to assign a weight to each of the candidate concepts;

[0021] According to the weights, a key concept is determined from the candidate concepts.

[0022] In some embodiments, in the step of using the TF-IDF algorithm to assign a weight to each of the candidate concepts, the calculation formula for assigning the weight is:

[0023] TF-IDF(t,d)=TF(t,d)×IDF(t)

[0024] Among them, TF is term frequency; IDF is inverse document frequency; t represents concept; and d represents document.

[0025] In some embodiments, the step of determining a set of target objects to be replaced in the target document comprises the following steps:

[0026] Divide the candidate concept set and formula set in the target document into four areas according to their weights, namely, the key concept area accounts for 10%, the high-weight concept area accounts for 30%, the low-weight concept area accounts for 50%, and the irrelevant concept area accounts for 10%;

[0027] Determine the number of concepts and formulas to be replaced based on scenario requirements;

[0028] The same number of concepts are randomly selected from the key concept area, the higher weight concept area and the lower weight concept area to form the concepts to be replaced, and the same number of formulas are randomly selected to form the formulas to be replaced.

[0029] In some embodiments, replacing the target object set in the target document according to the replacement set to generate a close-in honeyspot document comprises the following steps:

[0030] Design prompt words to explain to the large language model the concept set and formula set to be replaced in the document. The large language model generates fake content with confusing concepts based on the provided indicator words.

[0031] The generated honey spot documents are submitted to security personnel for review and feedback, and the documents that ultimately meet the review requirements are stored and archived.

[0032] Another aspect of the embodiment of the present invention further provides a system for generating close-up honey spot documents based on a large language model, including:

[0033] The first module is used to extract information of all key objects from the target document, wherein the key objects include key concepts and key formulas;

[0034] The second module is used to determine a set of target objects to be replaced in the target document;

[0035] A third module is used to generate a replacement set for replacing the target object set through a large language model;

[0036] A fourth module is used to replace the target object set in the target document according to the replacement set to generate a close honeyspot document;

[0037] The fifth module is used to repeatedly generate a plurality of the replacement sets, and further generate a plurality of the close-in honeyspot documents.

[0038] In some embodiments, the first module includes:

[0039] The first unit is used to build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas in the document collection;

[0040] The second unit is used to determine whether each document in the document set is a Chinese document or an English document, and obtain a set of initial concepts in each document; for Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length less than or equal to 6; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length less than or equal to 6;

[0041] The third unit is used to construct prompt words and remove noun phrases irrelevant to the topic in the initial concepts through a large language model to obtain a set of candidate concepts for each document;

[0042] The fourth unit is used to assign a weight to each of the candidate concepts using a TF-IDF algorithm;

[0043] The fifth unit is used to determine the key concept from the candidate concepts according to the weight;

[0044] In the step of using the TF-IDF algorithm to assign weights to each of the candidate concepts, the calculation formula for assigning weights is:

[0045] TF-IDF(t,d)=TF(t,d)×IDF(t)

[0046] Among them, TF is term frequency; IDF is inverse document frequency; t represents concept; and d represents document.

[0047] To achieve the above objective, another aspect of an embodiment of the present invention provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0048] To achieve the above objective, another aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned method is implemented.

[0049] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0050] The embodiments of the present invention include at least the following beneficial effects: the present invention provides a method and system for generating a close-body honey spot document based on a large language model, the scheme extracts information of all key objects from a target document, the key objects include key concepts and key formulas; determines a target object set to be replaced in the target document; generates a replacement set for replacing the target object set through a large language model; replaces the target object set in the target document according to the replacement set to generate a close-body honey spot document; repeatedly generates multiple replacement sets, and then generates multiple close-body honey spot documents. The embodiments of the present invention can effectively confuse and confuse attackers, making it difficult for them to easily distinguish between true and false documents, thereby improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0052] Figure 2 is a flow chart of the overall steps provided by an embodiment of the present invention;

[0053] Figure 3 It is a schematic diagram of generating a close-up honeyspot document provided by an embodiment of the present invention;

[0054] Figure 4 is a flowchart of the concept and formula for extracting documents provided by an embodiment of the present invention;

[0055] Figure 5 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present invention. They are only examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the attached claims.

[0057] It is understood that the terms "first", "second", etc. used in the present invention may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0058] The terms "at least one", "multiple", "each", "any", etc. used in the present invention, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0060] The purpose of the present invention is to address the deficiencies of the prior art in protecting important intellectual property documents and to propose a method for generating close-up honeyspot documents based on a large language model technology to prevent the leakage of important intellectual property rights. The method mainly includes:

[0061] 1. The present invention takes technical documents as the main protection object and generates false technical document content to confuse and confuse attackers, thereby improving the security of technical documents. It is suitable for protecting the core knowledge and proprietary technology of enterprises and preventing these important intellectual property rights from suffering losses due to data leakage.

[0062] 2. The present invention guides the large language model to generate honey spot content by designing fine prompt words. By utilizing the powerful generation capability of the large language model, it is possible to highly simulate real technical documents in terms of semantics and logic. Through carefully designed algorithms and strategies, the large language model can generate confusing false content, making it difficult for attackers to distinguish the authenticity of the document, thereby effectively confusing and delaying the attack behavior.

[0063] 3. The present invention avoids the simple method of selecting only the most important phrases in the document for replacement in the prior art by designing a replacement word selection strategy. The prior method easily causes the honey spot document content to appear mismatched, and can even be identified as a forged document at a glance.

[0064] 4. The present invention can quickly generate a large number of high-quality honey spot documents through the automatic generation mechanism of the large language model. This not only improves the efficiency of document generation, but also enables enterprises to deploy a large number of honey spot documents in a short period of time, thereby enhancing protection capabilities and adapting to frequent attacks.

[0065] The method and system for generating a close-body honey spot document based on a large language model provided in an embodiment of the present invention relate to the field of computer technology. The method for generating a close-body honey spot document based on a large language model provided in an embodiment of the present invention can be applied to a terminal, can be applied to a server, or can be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a vehicle-mounted terminal, etc., but is not limited thereto; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements a close-body honey spot document generation method based on a large language model, etc., but is not limited to the above forms.

[0066] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0067] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0068] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0069] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0070] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc. The terminal 102 may also be a vehicle-mounted terminal of various device types described above, but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment of the present invention.

[0071] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a method for generating a close-in honey spot document based on a large language model. The following is an example of applying the close-in honey spot document generation method based on a large language model in a server 101. It can be understood that the method can also be applied to a terminal 102.

[0072] Reference Figure 2 , Figure 2 The flowchart of the method for generating a close-to-body honeyspot document based on a large language model and applied to a server provided in an embodiment of the present invention, the execution subject of the method can be any of the aforementioned computer devices (including a server or a terminal). Figure 2 , the method may include the following steps:

[0073] Extracting information of all key objects from the target document, wherein the key objects include key concepts and key formulas;

[0074] Determining a set of target objects to be replaced in the target document;

[0075] Generate a replacement set for replacing the target object set by using a large language model;

[0076] Replace the target object set in the target document according to the replacement set to generate a close-in honeyspot document;

[0077] Repeatedly generate multiple replacement sets to generate multiple close-in honeyspot documents.

[0078] In some embodiments, extracting information of all key objects from the target document includes the following steps:

[0079] Build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas in the document collection;

[0080] Determine whether each document in the document collection is a Chinese document or an English document, and obtain a set of initial concepts in each document; for Chinese documents, use the jieba word segmentation library to extract nouns and noun phrases with a length less than or equal to 6; for English documents, use the jieba word segmentation library to extract nouns and noun phrases with a length less than or equal to 6;

[0081] By constructing prompt words, the noun phrases irrelevant to the topic in the initial concepts are eliminated through a large language model to obtain a set of candidate concepts for each document;

[0082] Use the TF-IDF algorithm to assign a weight to each of the candidate concepts;

[0083] According to the weights, a key concept is determined from the candidate concepts.

[0084] In some embodiments, in the step of using the TF-IDF algorithm to assign a weight to each of the candidate concepts, the calculation formula for assigning the weight is:

[0085] TF-IDF(t,d)=TF(t,d)×IDF(t)

[0086] Among them, TF is term frequency; IDF is inverse document frequency; t represents concept; and d represents document.

[0087] In some embodiments, the step of determining a set of target objects to be replaced in the target document comprises the following steps:

[0088] Divide the candidate concept set and formula set in the target document into four areas according to their weights, namely, the key concept area accounts for 10%, the high-weight concept area accounts for 30%, the low-weight concept area accounts for 50%, and the irrelevant concept area accounts for 10%;

[0089] Determine the number of concepts and formulas to be replaced based on scenario requirements;

[0090] The same number of concepts are randomly selected from the key concept area, the higher weight concept area and the lower weight concept area to form the concepts to be replaced, and the same number of formulas are randomly selected to form the formulas to be replaced.

[0091] In some embodiments, replacing the target object set in the target document according to the replacement set to generate a close-in honeyspot document comprises the following steps:

[0092] Design prompt words to explain to the large language model the concept set and formula set to be replaced in the document. The large language model generates fake content with confusing concepts based on the provided indicator words.

[0093] The generated honey spot documents are submitted to security personnel for review and feedback, and the documents that ultimately meet the review requirements are stored and archived.

[0094] The implementation process of the embodiment of the present invention in a specific application scenario is described in detail below with reference to the accompanying drawings of the specification:

[0095] In view of the problems existing in the prior art, the present invention needs to solve the following problems:

[0096] 1. The current technology is relatively weak in protecting enterprise technical documents and cannot effectively deal with the risk of technical documents being stolen. The present invention utilizes the powerful generation capability of the large language model to overcome the problem of complex content processing of technical documents and highly simulates real technical documents in semantics and logic.

[0097] 2. In the prior art, the generation of honey-bait documents often focuses on replacing only the most important phrases in the document. This single replacement strategy results in poor obfuscation of the document. The present invention reduces the risk of the honey-spot document content deviating from the topic by dividing the replaceable phrases into regions according to their importance.

[0098] 3. The existing honey bait technical document generation process is time-consuming and labor-intensive, resulting in a limited number of honey bait documents generated, which is difficult to meet the frequently changing security requirements. The automatic generation mechanism of the large language model can solve this problem well.

[0099] refer to Figure 3 The present invention provides a method for generating a close-up honey spot document based on a large language model, comprising the following steps:

[0100] 1. Extract key concepts and all formulas. The steps to extract key concepts are as follows: Figure 4 As shown:

[0101] 1.1. For a company, all documents are defined as a set D = {d0, d1, ..., d n}, each document d i , use the Stanford NLP interpreter to extract all formulas E in the document i The extraction formula can be expressed as follows, where e ij Represents document d i The jth formula in :

[0102] E i ={e i1 ,e i2 ,…,e ik}

[0103] 1.2. Next, determine whether it is a Chinese document or an English document. For Chinese documents, the Jieba word segmentation library is used to extract nouns and noun phrases with a length of less than or equal to 6. For English documents, the Stanford NLP interpreter is used to extract noun phrases with a length of less than or equal to 5. Using this method, each document can obtain a set of concept T i ={t i1 ,t i2 ,…,t ih}.

[0104] 1.3. Design prompts and discard noun phrases that are irrelevant to the topic through the large model, such as place names (Beijing, Shanghai), "illustration", "example" and other words. After removing these noun phrases, each document di can get a set of candidate concepts C i ={c i1 ,c i2 ,…,c im};

[0105] 1.4. Then use the TF-IDF algorithm to assign weights to candidate concepts. The larger the weight, the greater the influence of the term on the document. The TF-IDF calculation formula is:

[0106] TF-IDF(t,d)=TF(t,d)×IDF(t)

[0107] Among them, TF is the word frequency, defined as f t,d is the number of times concept t appears in document d. IDF is the inverse document frequency, N is the total number of documents and the denominator is the number of documents containing concept t.

[0108] 2. Determine the document d i The concept set R that should be replaced i and Formula Set RE i If each honey point is generated by the same concept, it will be obvious that the document d i Which concepts are replaced? If only the concepts with high weights are replaced, the forged document may appear not to be real enough. Therefore, the concept to be replaced is selected using the regional random method. The specific steps are as follows:

[0109] 2.1. The candidate concept set C i and Formula E iIt is divided into four areas according to the weight, namely, the key concept area accounts for 10%, the higher weight concept area accounts for 30%, the lower weight concept area accounts for 50%, and the irrelevant concept area accounts for 10%.

[0110] 2.2. Determine the number of concepts to be replaced as needed and the number of formulas to be replaced ( Much smaller than C i The number of internal concepts, Much smaller than E i the number of concepts within the

[0111] 2.3. Randomly select the same number of concepts in the first three areas to form the concepts to be replaced and the formula to replace

[0112] 3. Generate close honey spot documents. Get the set R to be replaced i and RE i The next task is to use the large language model to generate "similar concepts" and similar formulas to replace R i and RE i The concepts in the document are then used to generate the document d i The specific steps are as follows:

[0113] 3.1. Design prompts to explain to large language models that R should be replaced in the document i and RE i ,The large language model generates fake content with confusing concepts according to the provided instructions;

[0114] 3.2. The generated honey spot document can be expressed as: d′ i =Replace(d i ,R i ,S i ,RE i ,SE i ), where S i To replace R i Similar concept set, SE i To replace RE i A set of similar formulas for ;

[0115] 3.3. Submit the generated honey spot document to security personnel for review and feedback to ensure the obfuscation effect and security of the document;

[0116] 3.4. Store and archive the generated honey spot document d′.

[0117] 4. Repeat steps 2 to 3, reselect and replace concepts, and generate multiple versions of honey spot documents. i and RE i will be different, thus ensuring the diversity and confusion of the honey spots.

[0118] In summary, the present invention has the following characteristics:

[0119] 1. The present invention takes technical documents as the main protection object and generates false technical document content to confuse and confuse attackers, thereby improving the security of technical documents. It is suitable for protecting the core knowledge and proprietary technology of enterprises and preventing these important intellectual property rights from suffering losses due to data leakage.

[0120] 2. The present invention guides the large language model to generate honey spot content by designing fine prompt words. By utilizing the powerful generation capability of the large language model, it is possible to highly simulate real technical documents in terms of semantics and logic. Through carefully designed algorithms and strategies, the large language model can generate confusing false content, making it difficult for attackers to distinguish the authenticity of the document, thereby effectively confusing and delaying the attack behavior.

[0121] 3. The present invention avoids the simple method of selecting only the most important phrases in the document for replacement in the prior art by designing a replacement word selection strategy. The prior method easily causes the honey spot document content to appear mismatched, and can even be identified as a forged document at a glance.

[0122] 4. The present invention can quickly generate a large number of high-quality honey spot documents through the automatic generation mechanism of the large language model. This not only improves the efficiency of document generation, but also enables enterprises to deploy a large number of honey spot documents in a short period of time, thereby enhancing protection capabilities and adapting to frequent attacks.

[0123] Another aspect of the embodiment of the present invention further provides a system for generating close-up honey spot documents based on a large language model, including:

[0124] The first module is used to extract information of all key objects from the target document, wherein the key objects include key concepts and key formulas;

[0125] The second module is used to determine a set of target objects to be replaced in the target document;

[0126] A third module is used to generate a replacement set for replacing the target object set through a large language model;

[0127] A fourth module is used to replace the target object set in the target document according to the replacement set to generate a close honeyspot document;

[0128] The fifth module is used to repeatedly generate a plurality of the replacement sets, and further generate a plurality of the close-in honeyspot documents.

[0129] In some embodiments, the first module includes:

[0130] The first unit is used to build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas in the document collection;

[0131] The second unit is used to determine whether each document in the document set is a Chinese document or an English document, and obtain a set of initial concepts in each document; for Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length less than or equal to 6; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length less than or equal to 6;

[0132] The third unit is used to construct prompt words and remove noun phrases irrelevant to the topic in the initial concepts through a large language model to obtain a set of candidate concepts for each document;

[0133] The fourth unit is used to assign a weight to each of the candidate concepts using a TF-IDF algorithm;

[0134] The fifth unit is used to determine the key concept from the candidate concepts according to the weight;

[0135] In the step of using the TF-IDF algorithm to assign weights to each of the candidate concepts, the calculation formula for assigning weights is:

[0136] TF-IDF(t,d)=TF(t,d)×IDF(t)

[0137] Among them, TF is term frequency; IDF is inverse document frequency; t represents concept; and d represents document.

[0138] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0139] The embodiment of the present invention further provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned method for generating close-body honey spot documents based on a large language model when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0140] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0141] See also Figure 5 , Figure 5 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0142] The processor 501 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0143] The memory 502 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 502 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 502, and the processor 501 calls and executes the close-in honey spot document generation method based on a large language model in the embodiment of the present invention;

[0144] Input / output interface 503, used to implement information input and output;

[0145] Communication interface 504, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0146] A bus 505 that transmits information between the various components of the device (e.g., the processor 501, the memory 502, the input / output interface 503, and the communication interface 504);

[0147] The processor 501 , the memory 502 , the input / output interface 503 and the communication interface 504 are connected to each other in communication within the device via the bus 505 .

[0148] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the method for generating a close-in honeyspot document based on a large language model is implemented.

[0149] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0150] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0151] It should be noted that in various specific embodiments of the present invention, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present invention needs to obtain the user's sensitive personal information, it will obtain the user's separate permission or consent through a pop-up window or jump to a confirmation page, and after clearly obtaining the user's separate permission or consent, it will obtain the necessary user-related data for the normal operation of the embodiment of the present invention.

[0152] The embodiments described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art can appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0153] Those skilled in the art will appreciate that the technical solutions shown in the figures do not limit the embodiments of the present invention and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0154] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0155] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0156] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0157] It should be understood that in the present invention, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can represent: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0158] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0159] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0160] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0161] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store programs.

[0162] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the embodiments of the present invention is not limited thereby. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the embodiments of the present invention shall be within the scope of the rights of the embodiments of the present invention.

Claims

1. A method for generating close-up honey spot documents based on a large language model, characterized in that: The following steps are involved: Extracting information of all key objects from the target document, wherein the key objects include key concepts and key formulas; Determining a set of target objects to be replaced in the target document; Generate a replacement set for replacing the target object set by using a large language model; Replace the target object set in the target document according to the replacement set to generate a close-in honeyspot document; Repeatedly generate multiple replacement sets to generate multiple close-in honeyspot documents.

2. The method for generating close-in honeyspot documents based on a large language model according to claim 1, characterized in that: The step of extracting information of all key objects from the target document comprises the following steps: Build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas in the document collection; Determine whether each document in the document collection is a Chinese document or an English document, and obtain a set of initial concepts in each document; for Chinese documents, use the jieba word segmentation library to extract nouns and noun phrases with a length less than or equal to 6; for English documents, use the jieba word segmentation library to extract nouns and noun phrases with a length less than or equal to 6; By constructing prompt words, the noun phrases irrelevant to the topic in the initial concepts are eliminated through a large language model to obtain a set of candidate concepts for each document; Use the TF-IDF algorithm to assign a weight to each of the candidate concepts; According to the weights, a key concept is determined from the candidate concepts.

3. The method for generating close-in honeyspot documents based on a large language model according to claim 2, characterized in that: In the step of using the TF-IDF algorithm to assign weights to each of the candidate concepts, the calculation formula for assigning weights is: TF-IDF(t,d)=TF(t,d)×IDF(t) Among them, TF is term frequency; IDF is inverse document frequency; t represents concept; and d represents document.

4. The method for generating close-in honeyspot documents based on a large language model according to claim 1, characterized in that: The step of determining a target object set to be replaced in the target document comprises the following steps: Divide the candidate concept set and formula set in the target document into four areas according to their weights, namely, the key concept area accounts for 10%, the high-weight concept area accounts for 30%, the low-weight concept area accounts for 50%, and the irrelevant concept area accounts for 10%; Determine the number of concepts and formulas to be replaced based on scenario requirements; The same number of concepts are randomly selected from the key concept area, the higher weight concept area and the lower weight concept area to form the concepts to be replaced, and the same number of formulas are randomly selected to form the formulas to be replaced.

5. The method for generating close-in honeyspot documents based on a large language model according to claim 1, characterized in that: The step of replacing the target object set in the target document according to the replacement set to generate a close-in honeyspot document comprises the following steps: Design prompt words to explain to the large language model the concept set and formula set to be replaced in the document. The large language model generates fake content with confusing concepts based on the provided indicator words. The generated honey spot documents are submitted to security personnel for review and feedback, and the documents that ultimately meet the review requirements are stored and archived.

6. A close-up honey spot document generation system based on a large language model, characterized in that: include: The first module is used to extract information of all key objects from the target document, wherein the key objects include key concepts and key formulas; The second module is used to determine a set of target objects to be replaced in the target document; A third module is used to generate a replacement set for replacing the target object set through a large language model; A fourth module is used to replace the target object set in the target document according to the replacement set to generate a close honeyspot document; The fifth module is used to repeatedly generate a plurality of the replacement sets, and further generate a plurality of the close-in honeyspot documents.

7. The system for generating close-in honeyspot documents based on a large language model according to claim 6, characterized in that: The first module includes: The first unit is used to build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas in the document collection; The second unit is used to determine whether each document in the document set is a Chinese document or an English document, and obtain a set of initial concepts in each document; for Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length less than or equal to 6; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length less than or equal to 6; The third unit is used to construct prompt words and remove noun phrases irrelevant to the topic in the initial concepts through a large language model to obtain a set of candidate concepts for each document; The fourth unit is used to assign a weight to each of the candidate concepts using a TF-IDF algorithm; The fifth unit is used to determine the key concept from the candidate concepts according to the weight; In the step of using the TF-IDF algorithm to assign weights to each of the candidate concepts, the calculation formula for assigning weights is: TF-IDF(t,d)=TF(t,d)×IDF(t) Among them, TF is term frequency; IDF is inverse document frequency; t represents concept; and d represents document.

8. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images