A method and system for generating honeypot documents based on a large language model

Abstract

This invention discloses a method and system for generating honeypot documents based on a large language model. The method includes: extracting information of all key objects from a target document, wherein the key objects include key concepts and key formulas; determining a set of target objects to be replaced in the target document; generating a replacement set for replacing the set of target objects using a large language model; replacing the set of target objects in the target document according to the replacement set to generate a honeypot document; and repeatedly generating multiple replacement sets to generate multiple honeypot documents. This invention can effectively obfuscate and confuse attackers, making it difficult for them to distinguish between genuine and fake documents, thereby improving system security and can be widely applied in the field of computer technology.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and system for generating close-range honeypot documents based on a large language model. Background Technology

[0002] As remote work becomes increasingly common, data breaches are also occurring frequently, making the current state of network information security increasingly severe.

[0003] Honeycomb techniques are typically used to lure attackers into accessing forged sensitive information in order to detect and analyze attack behavior. However, existing honeycomb techniques mainly focus on creating fake sensitive information (such as passwords, account information, and financial data), while the protection of corporate technical documents is relatively weak. Technical documents usually contain a company's core knowledge and proprietary technology, and are an important part of its competitiveness. When attackers infiltrate a company's system, they often steal a large number of documents. Once these documents are maliciously obtained, they can cause incalculable losses to the company. Existing honeycomb documents focus on obviously sensitive information, such as personal data or financial records, while the protection of important corporate technical documents is relatively insufficient. Furthermore, the generation of existing honeycomb documents relies on manual operation or simple automated tools, making it difficult to quickly generate large quantities of high-quality honeycomb documents and unable to cope with complex and ever-changing attack methods.

[0004] Existing honey bait technology has the following drawbacks:

[0005] 1. The document content mostly focuses on sensitive information and neglects technical documents. Existing technology overlooks technical documents as an important object of protection. However, corporate technical documents often contain the company's core knowledge and proprietary technology, which are key components of the company's competitiveness. Once these documents are obtained by attackers, they will cause serious intellectual property and competitive losses to the company.

[0006] 2. The document content lacks realism. Existing honey bait generation technologies typically use simple replacement algorithms or template methods when generating content. These methods cannot handle complex semantic and logical relationships, resulting in documents that lack authenticity in both content and logic.

[0007] 3. The selection strategy for replacing document content is too simplistic. Existing technologies only select highly important phrases in the document for replacement, making it easy to identify the falsification of the content.

[0008] 4. Low document generation efficiency. Traditional honeypot generation technology has significant shortcomings in automation and intelligence, relying on manual adjustments and settings. This not only makes the generation process time-consuming and labor-intensive, but also limits the number of honeypot documents generated, making large-scale deployment difficult. Summary of the Invention

[0009] The main objective of this invention is to propose an efficient method and system for generating honeypot documents based on a large language model. This method can effectively confuse and mislead attackers, making it difficult for them to distinguish between genuine and fake documents, thereby improving the security of the system.

[0010] To achieve the above objectives, one aspect of this invention proposes a method for generating close-range honeypot documents based on a large language model, comprising the following steps:

[0011] Extract information from all key objects in the target document, including key concepts and key formulas;

[0012] Determine the set of target objects to be replaced in the target document;

[0013] A replacement set for replacing the target object set is generated using a large language model;

[0014] The target object set in the target document is replaced according to the replacement set to generate a close-up honey spot document;

[0015] Multiple replacement sets are repeatedly generated, thereby generating multiple close-up honey spot documents.

[0016] In some embodiments, extracting information about all key objects from the target document includes the following steps:

[0017] All documents are compiled into a document collection, and the Stanford NLP interpreter is used to extract all the key formulas from the document collection;

[0018] Each document in the document collection is determined to be either a Chinese document or an English document, and a set of initial concepts is obtained for each document. For Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less.

[0019] By constructing prompt words and using a large language model to remove noun phrases that are irrelevant to the topic from the initial concepts, a set of candidate concepts is obtained for each document.

[0020] Weights were assigned to each candidate concept using the TF-IDF algorithm;

[0021] Based on their weights, key concepts are determined from the candidate concepts.

[0022] In some embodiments, in the step of assigning weights to each candidate concept using the TF-IDF algorithm, the formula for calculating the weights is as follows:

[0023] TF-IDF(t,d) = TF(t,d) × IDF(t)

[0024] Where TF stands for term frequency; IDF stands for inverse document frequency; t represents a concept; and d represents a document.

[0025] In some embodiments, determining the set of target objects to be replaced in the target document includes the following steps:

[0026] The candidate concept set and formula set in the target document are divided into four regions according to their weight: key concept area (10%), high-weight concept area (30%), low-weight concept area (50%), and irrelevant concept area (10%).

[0027] Determine the number of concepts and formulas to be replaced based on the requirements of the scenario;

[0028] The same number of concepts are randomly selected from the key concept area, the concept area with high weight, and the concept area with low weight to form the concept to be replaced, and the same number of formulas are randomly selected to form the formula to be replaced.

[0029] In some embodiments, replacing the set of target objects in the target document according to the replacement set to generate a close-up honey spot document includes the following steps:

[0030] The design prompts provide the large language model with the set of concepts and formulas to be replaced in the documentation. Based on the provided prompts, the large language model generates fake content with confusing concepts.

[0031] The generated honey spot documents are submitted to security personnel for review and feedback, and the documents that finally meet the review requirements are stored and archived.

[0032] Another aspect of this invention provides a proximity honeypot document generation system based on a large language model, comprising:

[0033] The first module is used to extract information about all key objects from the target document, including key concepts and key formulas.

[0034] The second module is used to determine the set of target objects to be replaced in the target document;

[0035] The third module is used to generate a replacement set for replacing the target object set through a large language model;

[0036] The fourth module is used to replace the set of target objects in the target document according to the replacement set, and generate a close-up honey spot document;

[0037] The fifth module is used to repeatedly generate multiple replacement sets, thereby generating multiple close-up honey spot documents.

[0038] In some embodiments, the first module includes:

[0039] The first unit is used to build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas from the document collection;

[0040] The second unit is used to determine whether each document in the document collection is a Chinese document or an English document, and to obtain a set of initial concepts for each document. Specifically, for Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less.

[0041] The third unit is used to construct prompt words and use a large language model to remove noun phrases that are irrelevant to the topic from the initial concepts, so as to obtain a set of candidate concepts for each document.

[0042] The fourth unit is used to assign weights to each of the candidate concepts using the TF-IDF algorithm;

[0043] The fifth unit is used to determine the key concepts from the candidate concepts based on their weights.

[0044] In the step of assigning weights to each candidate concept using the TF-IDF algorithm, the formula for calculating the weights is as follows:

[0045] TF-IDF(t,d) = TF(t,d) × IDF(t)

[0046] Where TF stands for term frequency; IDF stands for inverse document frequency; t represents a concept; and d represents a document.

[0047] To achieve the above objectives, another aspect of the present invention provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0048] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0049] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0050] The embodiments of this invention include at least the following beneficial effects: This invention provides a method and system for generating honeypot documents based on a large language model. This method extracts information on all key objects from a target document, including key concepts and key formulas; determines a set of target objects to be replaced in the target document; generates a replacement set for replacing the set of target objects using a large language model; replaces the set of target objects in the target document according to the replacement set, generating a honeypot document; and repeatedly generates multiple replacement sets, thereby generating multiple honeypot documents. The embodiments of this invention can effectively confuse and mislead attackers, making it difficult for them to distinguish between genuine and fake documents, thus improving system security. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0052] Figure 2 This is a flowchart of the overall steps provided in the embodiments of the present invention;

[0053] Figure 3 This is a schematic diagram of the close-range honey spot document generation provided in an embodiment of the present invention;

[0054] Figure 4 This is a flowchart of extracting document concepts and formulas provided in an embodiment of the present invention;

[0055] Figure 5 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0057] It is understood that the terms “first,” “second,” etc., used in this invention may be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, first information may also be referred to as second information without departing from the scope of embodiments of the invention, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to determination” as used herein may be interpreted as “when…” or “when…” or “in response to determination.”

[0058] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0060] The purpose of this invention is to address the shortcomings of existing technologies in protecting important intellectual property documents by proposing a method based on large language model technology to generate close-proximity honey spot documents to prevent the leakage of important intellectual property rights. This method mainly includes:

[0061] 1. This invention enhances the security of technical documents by generating falsified technical document content, primarily protecting technical documents, to confuse and mislead attackers. It is suitable for protecting a company's core knowledge and proprietary technology, preventing the loss of these important intellectual property rights due to data breaches.

[0062] 2. This invention guides a large language model to generate deceptive content by designing sophisticated prompts. Leveraging the powerful generative capabilities of the large language model, it can highly simulate real technical documents semantically and logically. Through carefully designed algorithms and strategies, the large language model can generate misleading and deceptive content, making it difficult for attackers to distinguish the authenticity of the document, thereby effectively confusing and delaying attack behavior.

[0063] 3. This invention, through the design of a replacement word selection strategy, avoids the simplistic approach of existing technologies that merely selects highly important phrases from the document for replacement. Existing methods easily lead to mismatched content in honeypot documents, and can even be easily identified as forged documents.

[0064] 4. This invention, through an automated generation mechanism based on a large language model, can quickly generate a large number of high-quality honeypot documents. This not only improves the efficiency of document generation but also enables enterprises to deploy a large number of honeypot documents in a short period of time, thereby enhancing their protection capabilities and adapting to frequent attacks.

[0065] The method and system for generating honeypot documents based on a large language model provided in this invention relates to the field of computer technology. The method for generating honeypot documents based on a large language model can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the method for generating honeypot documents based on a large language model, but is not limited to the above forms.

[0066] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0067] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided by an embodiment of the present invention. (Refer to...) Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0068] Server 101 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0069] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0070] Terminal 102 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc. It can also be a vehicle-mounted terminal of the various device types described above, but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the invention does not impose any limitations.

[0071] Exemplary based on Figure 1 The implementation environment shown in this embodiment of the invention provides a method for generating close-range honeypot documents based on a large language model. The following description uses the application of this method in server 101 as an example. It is understood that this method can also be applied in terminal 102.

[0072] Reference Figure 2 , Figure 2 The flowchart illustrates a method for generating proximity honeypot documents based on a large language model for use on a server, as provided in this embodiment of the invention. The execution entity of this method can be any of the aforementioned computer devices (including a server or terminal). See also... Figure 2 The method may include the following steps:

[0073] Extract information from all key objects in the target document, including key concepts and key formulas;

[0074] Determine the set of target objects to be replaced in the target document;

[0075] A replacement set for replacing the target object set is generated using a large language model;

[0076] The target object set in the target document is replaced according to the replacement set to generate a close-up honey spot document;

[0077] Multiple replacement sets are repeatedly generated, thereby generating multiple close-up honey spot documents.

[0078] In some embodiments, extracting information about all key objects from the target document includes the following steps:

[0079] All documents are compiled into a document collection, and the Stanford NLP interpreter is used to extract all the key formulas from the document collection;

[0080] Each document in the document collection is determined to be either a Chinese document or an English document, and a set of initial concepts is obtained for each document. For Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less.

[0081] By constructing prompt words and using a large language model to remove noun phrases that are irrelevant to the topic from the initial concepts, a set of candidate concepts is obtained for each document.

[0082] Weights were assigned to each candidate concept using the TF-IDF algorithm;

[0083] Based on their weights, key concepts are determined from the candidate concepts.

[0084] In some embodiments, in the step of assigning weights to each candidate concept using the TF-IDF algorithm, the formula for calculating the weights is as follows:

[0085] TF-IDF(t,d) = TF(t,d) × IDF(t)

[0086] Where TF stands for term frequency; IDF stands for inverse document frequency; t represents a concept; and d represents a document.

[0087] In some embodiments, determining the set of target objects to be replaced in the target document includes the following steps:

[0088] The candidate concept set and formula set in the target document are divided into four regions according to their weight: key concept area (10%), high-weight concept area (30%), low-weight concept area (50%), and irrelevant concept area (10%).

[0089] Determine the number of concepts and formulas to be replaced based on the requirements of the scenario;

[0090] The same number of concepts are randomly selected from the key concept area, the concept area with high weight, and the concept area with low weight to form the concept to be replaced, and the same number of formulas are randomly selected to form the formula to be replaced.

[0091] In some embodiments, replacing the set of target objects in the target document according to the replacement set to generate a close-up honey spot document includes the following steps:

[0092] The design prompts provide the large language model with the set of concepts and formulas to be replaced in the documentation. Based on the provided prompts, the large language model generates fake content with confusing concepts.

[0093] The generated honey spot documents are submitted to security personnel for review and feedback, and the documents that finally meet the review requirements are stored and archived.

[0094] The implementation process of the embodiments of the present invention in specific application scenarios will be described in detail below with reference to the accompanying drawings:

[0095] To address the problems existing in the prior art, the present invention aims to solve the following issues:

[0096] 1. Current technologies are relatively weak in protecting enterprise technical documents and cannot effectively address the risk of technical documents being stolen. This invention utilizes the powerful generation capabilities of large language models to overcome the complexity of technical document content processing, achieving a high degree of semantic and logical simulation of real technical documents.

[0097] 2. Existing technologies for generating honeypot documents often focus solely on replacing highly important phrases within the document. This singular replacement strategy results in poor document obfuscation. This invention reduces the risk of honeypot documents deviating from the topic by dividing replaceable phrases into regions based on their importance.

[0098] 3. The existing honey bait technology documentation generation process is time-consuming and labor-intensive, resulting in a limited number of honey bait documents that cannot meet frequently changing security requirements. The automated generation mechanism of the large language model effectively solves this problem.

[0099] refer to Figure 3 This invention provides a method for generating close-range honeypot documents based on a large language model, comprising the following steps:

[0100] 1. Extract key concepts and all formulas. The steps for extracting key concepts are as follows: Figure 4 As shown:

[0101] 1.1. For a company, all documents are defined as a set D = {d0, d1, ..., dn}. n}, each document d i Use the Stanford NLP interpreter to extract all formulas E from the document. i The extraction formula can be expressed as follows, where e ij Representative document d i The j-th formula in:

[0102] E i ={e i1 ,e i2 ,…,e ik}

[0103] 1.2 Next, determine whether the document is in Chinese or English. For Chinese documents, use the jieba word segmentation library to extract nouns and noun phrases with a length of 6 or less. For English documents, use the Stanford NLP interpreter to extract noun phrases with a length of 5 or less. Using this method, each document can yield a set of concepts T. i ={t i1 ,t i2 ,…,t ih}

[0104] 1.3 Design a prompt that uses a large model to discard nouns and phrases irrelevant to the topic, such as place names (Beijing, Shanghai), words like "illustration," and "example." After removing these nouns and phrases, each document di can obtain a set of candidate concepts C. i ={c i1 ,c i2 ,…,c im};

[0105] 1.4 Next, the TF-IDF algorithm is used to assign weights to candidate concepts. A larger weight indicates a greater influence of the term on the document. The TF-IDF calculation formula is:

[0106] TF-IDF(t,d) = TF(t,d) × IDF(t)

[0107] Where TF stands for term frequency, defined as f t,d Let be the number of times concept t appears in document d. IDF stands for Inverse Document Frequency. N is the total number of documents, and the denominator is the number of documents containing the concept t.

[0108] 2. Determine document d i The set of concepts that should be replaced, R i and formula set RE i If each honeypot generation uses the same concept, it will be obvious from document d. i Which concepts were replaced? Replacing only high-weight concepts might make the forged document seem less authentic. Therefore, a region-based random selection method was used to choose the concepts to be replaced. The specific steps are as follows:

[0109] 2.1 The candidate concept set C i and formula set E iThe concepts are divided into four regions based on their weight: 10% for key concepts, 30% for concepts with higher weight, 50% for concepts with lower weight, and 10% for irrelevant concepts.

[0110] 2.2 Determine the number of concepts to be replaced as needed. and the number of formulas to be replaced ( Much smaller than C i The number of internal concepts Much smaller than E i (Number of internal concepts).

[0111] 2.3. Randomly select the same number of concepts from the first three regions to form the concepts to be replaced. and the formula to be replaced

[0112] 3. Generate the close-range honey spot document. The set R to be replaced is obtained. i and RE i The next task is to use a large language model to generate "similar concepts" and similarity formulas to replace R. i and RE i The concept in d is used to generate the document d i The specific steps for getting close to the honey spot are as follows:

[0113] 3.1 Design a prompt to replace R in the large language model documentation. i and RE i The large language model generates fake content with confusing concepts based on the provided instructions;

[0114] 3.2 The generated honey spot document can be represented as: d′ i =Replace(d i ,R i ,S i RE i SE i ), where S i To replace R i Similar concept set, SE i To replace RE i A set of similar formulas;

[0115] 3.3 Submit the generated honeypot document to security personnel for review and feedback to ensure the obfuscation effect and security of the document;

[0116] 3.4 Store and archive the generated honey spot document d′.

[0117] 4. Repeat steps 2-3, reselecting and replacing concepts to generate multiple versions of the honeypot document. In each generated system proximity honeypot, R... i and RE i There will be differences, thus ensuring the diversity and confusion of honey spots.

[0118] In summary, the present invention has the following characteristics:

[0119] 1. This invention enhances the security of technical documents by generating falsified technical document content, primarily protecting technical documents, to confuse and mislead attackers. It is suitable for protecting a company's core knowledge and proprietary technology, preventing the loss of these important intellectual property rights due to data breaches.

[0120] 2. This invention guides a large language model to generate deceptive content by designing sophisticated prompts. Leveraging the powerful generative capabilities of the large language model, it can highly simulate real technical documents semantically and logically. Through carefully designed algorithms and strategies, the large language model can generate misleading and deceptive content, making it difficult for attackers to distinguish the authenticity of the document, thereby effectively confusing and delaying attack behavior.

[0121] 3. This invention, through the design of a replacement word selection strategy, avoids the simplistic approach of existing technologies that merely selects highly important phrases from the document for replacement. Existing methods easily lead to mismatched content in honeypot documents, and can even be easily identified as forged documents.

[0122] 4. This invention, through an automated generation mechanism based on a large language model, can quickly generate a large number of high-quality honeypot documents. This not only improves the efficiency of document generation but also enables enterprises to deploy a large number of honeypot documents in a short period of time, thereby enhancing their protection capabilities and adapting to frequent attacks.

[0123] Another aspect of this invention provides a proximity honeypot document generation system based on a large language model, comprising:

[0124] The first module is used to extract information about all key objects from the target document, including key concepts and key formulas.

[0125] The second module is used to determine the set of target objects to be replaced in the target document;

[0126] The third module is used to generate a replacement set for replacing the target object set through a large language model;

[0127] The fourth module is used to replace the set of target objects in the target document according to the replacement set, and generate a close-up honey spot document;

[0128] The fifth module is used to repeatedly generate multiple replacement sets, thereby generating multiple close-up honey spot documents.

[0129] In some embodiments, the first module includes:

[0130] The first unit is used to build a document collection from all documents and use the Stanford NLP interpreter to extract all the key formulas from the document collection;

[0131] The second unit is used to determine whether each document in the document collection is a Chinese document or an English document, and to obtain a set of initial concepts for each document. Specifically, for Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less.

[0132] The third unit is used to construct prompt words and use a large language model to remove noun phrases that are irrelevant to the topic from the initial concepts, so as to obtain a set of candidate concepts for each document.

[0133] The fourth unit is used to assign weights to each of the candidate concepts using the TF-IDF algorithm;

[0134] The fifth unit is used to determine the key concepts from the candidate concepts based on their weights.

[0135] In the step of assigning weights to each candidate concept using the TF-IDF algorithm, the formula for calculating the weights is as follows:

[0136] TF-IDF(t,d) = TF(t,d) × IDF(t)

[0137] Where TF stands for term frequency; IDF stands for inverse document frequency; t represents a concept; and d represents a document.

[0138] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0139] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned method for generating proximity honeypot documents based on a large language model. This electronic device can be any smart terminal, including tablet computers and in-vehicle computers.

[0140] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0141] Please see Figure 5 , Figure 5 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0142] The processor 501 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0143] The memory 502 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 502 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 502 and is called and executed by the processor 501 to implement the proximity honeypot document generation method based on a large language model according to the embodiments of this invention.

[0144] The input / output interface 503 is used to implement information input and output;

[0145] The communication interface 504 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0146] Bus 505 transmits information between various components of the device (e.g., processor 501, memory 502, input / output interface 503, and communication interface 504);

[0147] The processor 501, memory 502, input / output interface 503, and communication interface 504 are connected to each other within the device via bus 505.

[0148] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for generating close-range honeypot documents based on a large language model.

[0149] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0150] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0151] It should be noted that in various specific embodiments of the present invention, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of the present invention require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to a confirmation page. Only after obtaining the user's separate permission or consent is the necessary user-related data for the normal operation of the embodiments of the present invention acquired.

[0152] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0153] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0154] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0155] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0156] The terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0157] It should be understood that in this invention, "at least one (item)" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0158] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0159] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0160] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0161] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0162] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.

Claims

1. A method for generating honeypot documents based on a large language model, characterized in that, Includes the following steps: Extract information from all key objects in the target document, including key concepts and key formulas; Determine the set of target objects to be replaced in the target document; A replacement set for replacing the target object set is generated using a large language model; The target object set in the target document is replaced according to the replacement set to generate a close-up honey spot document; Multiple replacement sets are repeatedly generated, thereby generating multiple close-range honey spot documents; The process of extracting information from all key objects in the target document includes the following steps: All documents are compiled into a document collection, and the Stanford NLP interpreter is used to extract all the key formulas from the document collection; Each document in the document collection is determined to be either a Chinese document or an English document, and a set of initial concepts is obtained for each document. For Chinese documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less; for English documents, the jieba word segmentation library is used to extract nouns and noun phrases with a length of 6 or less. By constructing prompt words and using a large language model to remove noun phrases that are irrelevant to the topic from the initial concepts, a set of candidate concepts is obtained for each document. Weights were assigned to each candidate concept using the TF-IDF algorithm; Based on their weights, key concepts are determined from the candidate concepts. In the step of assigning weights to each candidate concept using the TF-IDF algorithm, the formula for calculating the weights is as follows: in, For word frequency; Inverse document frequency; Representative concept; Representative document; Determining the set of target objects to be replaced in the target document includes the following steps: The candidate concept set and formula set in the target document are divided into four regions according to their weight: key concept area (10%), high-weight concept area (30%), low-weight concept area (50%), and irrelevant concept area (10%). Determine the number of concepts and formulas to be replaced based on the requirements of the scenario; The same number of concepts are randomly selected from the key concept area, the concept area with high weight, and the concept area with low weight to form the concept to be replaced, and the same number of formulas are randomly selected to form the formula to be replaced. The step of replacing the target object set in the target document according to the replacement set to generate a close-up honey spot document includes the following steps: The design prompts provide the large language model with the set of concepts and formulas to be replaced in the documentation. Based on the provided prompts, the large language model generates fake content with confusing concepts. The generated honey spot documents are submitted to security personnel for review and feedback, and the documents that finally meet the review requirements are stored and archived.

2. A system for implementing the proximity honeypot document generation method based on a large language model as described in claim 1, characterized in that, include: The first module is used to extract information about all key objects from the target document, including key concepts and key formulas. The second module is used to determine the set of target objects to be replaced in the target document; The third module is used to generate a replacement set for replacing the target object set through a large language model; The fourth module is used to replace the set of target objects in the target document according to the replacement set, and generate a close-up honey spot document; The fifth module is used to repeatedly generate multiple replacement sets, thereby generating multiple close-up honey spot documents.

3. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in claim 1.

4. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in claim 1.

5. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in claim 1.

Images