Corpus data generation method and device and storage medium

Abstract

The embodiment of the invention provides a corpus data generation method and device and a storage medium, which are used for improving the comprehensiveness of corpus data. The method comprises the steps of obtaining log data; generating a problem set based on the log data, wherein the problem set comprises one or more of a first problem generated by performing log interpretation on the log data, a second problem generated by performing log risk analysis on the log data, and a third problem generated by performing threat research and judgment on the log data; and based on the log data and the question set, generating answer data, and obtaining corpus data corresponding to the log data.

Description

Technical Field

[0001] The present application relates to the technical field of natural language processing, and in particular to a method, device and storage medium for generating corpus data. Background Art

[0002] Security devices such as Web Application Firewall (WAF), Intrusion Prevention System (IPS) or host security system will generate a large amount of log alarm information during operation. The amount of these log alarm information is huge, so in order to improve the efficiency of security operations, these log alarm information needs to be noise-reduced.

[0003] In recent years, with the continuous development of artificial intelligence technology, noise reduction processing of log alarm information based on large language model (LLM) technology has gradually become a research hotspot. By learning and analyzing massive log data, the large language model can automatically identify and filter low-priority or repeated log alarm information (i.e., denoise the log alarm information). The accuracy of the large language model in denoising log alarm information is related to the corpus data used to optimize the large language model. Therefore, how to improve the comprehensiveness of the corpus data is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide a method, device and storage medium for generating corpus data, which are used to improve the comprehensiveness of corpus data.

[0005] In a first aspect, an embodiment of the present application provides a method for generating corpus data, the method comprising: obtaining log data; generating a question set based on the log data, the question set comprising: one or more of a first question generated by performing log interpretation on the log data, a second question generated by performing log risk analysis on the log data, and a third question generated by performing threat assessment on the log data; generating answer data based on the log data and the question set to obtain corpus data corresponding to the log data.

[0006] In one possible implementation, the log data is interpreted, including one or more of the following: parsing the request contained in the log data to determine whether the request is a normal request or an abnormal request, and the request frequency and / or parameter length of the abnormal request are not within the corresponding parameter range; interpreting the fields included in the log data to obtain the log content of the log data; or obtaining an associated log associated with the log data, and determining the attack behavior of the log data based on the log data and the associated log, the attack behavior including the attack behavior across time periods or the attack behavior across requests.

[0007] In one possible implementation, performing log risk analysis on the log data includes: analyzing the requests contained in the log data to determine whether the request is an abnormal request or a normal request, and when the request is an abnormal request, determining abnormal features corresponding to the request, and evaluating the risk index of the log data based on the abnormal features, the request frequency and / or parameter length of the abnormal request are not within the corresponding parameter range; and / or determining the source address corresponding to the request included in the log data, and evaluating the risk index of the log data based on the source address.

[0008] In one possible implementation, threat analysis is performed on the log data, including one or more of the following: identifying the attack type of the log data, and determining whether the log data will threaten security based on the attack type; analyzing behavioral characteristics of the requests included in the log data to determine the attack intent and attack target of the log data; or obtaining associated logs associated with the log data, and determining the attack path based on the log data and the associated logs.

[0009] In one possible implementation, the method further includes: generating a fourth question based on one or more results of the log interpretation, log risk analysis, and threat assessment, wherein the fourth question is related to a disposal suggestion for processing the request included in the log data, and the question set also includes the fourth question.

[0010] In a possible implementation, the handling suggestion includes one or more of the following: blocking access; updating defense rules; enhancing log monitoring; isolating associated devices, which are related to the request included in the log data; or generating alarm information.

[0011] In a possible implementation, the log data comes from a first log set, and the method further includes: obtaining a second log set; classifying the log data included in the second log set according to attack type; determining a target attack type whose log data quantity is less than a threshold; generating target log data corresponding to the target attack type according to attack characteristics of the target attack type; and determining that a set formed by the second log set and the target log data is the first log set.

[0012] In a possible implementation, the method further includes: adding a first identifier to the target log data, where the first identifier is used to indicate that the corresponding log data is log data to be reviewed.

[0013] In a second aspect, a communication device is provided, including: an acquisition module for acquiring log data; a processing module for generating a question set based on the log data, the question set including: one or more of a first question generated by performing log interpretation on the log data, a second question generated by performing log risk analysis on the log data, and a third question generated by performing threat assessment on the log data; and, generating answer data based on the log data and the question set to obtain corpus data corresponding to the log data.

[0014] In one possible implementation, the processing module is used to interpret the log data in one or more of the following ways: parsing the request contained in the log data to determine whether the request is a normal request or an abnormal request, and the request frequency and / or parameter length of the abnormal request is not within the corresponding parameter range; interpreting the fields included in the log data to obtain the log content of the log data; or obtaining an associated log associated with the log data, and determining the attack behavior of the log data based on the log data and the associated log, the attack behavior including attack behavior across time periods or attack behavior across requests.

[0015] In one possible implementation, the processing module is used to perform log risk analysis on the log data in the following manner: analyzing the requests contained in the log data to determine whether the request is an abnormal request or a normal request; when the request is an abnormal request, determining abnormal features corresponding to the request, and evaluating the risk index of the log data based on the abnormal features, the request frequency and / or parameter length of the abnormal request are not within the corresponding parameter range; and / or determining the source address corresponding to the request included in the log data, and evaluating the risk index of the log data based on the source address.

[0016] In one possible implementation, the processing module is used to perform threat analysis on the log data in one or more of the following ways: identifying the attack type of the log data, and determining whether the log data will threaten security based on the attack type; analyzing the behavioral characteristics of the requests included in the log data, and determining the attack intent and attack target of the log data; or, obtaining associated logs associated with the log data, and determining the attack path based on the log data and the associated logs.

[0017] In a possible implementation, the processing module is also used to generate a fourth question based on one or more results of the log interpretation, log risk analysis, and threat assessment, wherein the fourth question is related to a disposal suggestion for processing the request included in the log data, and the question set also includes the fourth question.

[0018] In a possible implementation, the handling suggestion includes one or more of the following: blocking access; updating defense rules; enhancing log monitoring; isolating associated devices, which are related to the request included in the log data; or generating alarm information.

[0019] In a possible implementation, the log data comes from a first log set, and the acquisition module is further used to: acquire a second log set; the processing module is further used to: classify the log data included in the second log set according to attack type; determine a target attack type whose log data quantity is less than a threshold; generate target log data corresponding to the target attack type according to attack characteristics of the target attack type; and determine that a set formed by the second log set and the target log data is the first log set.

[0020] In a possible implementation manner, the processing module is further used to: add a first identifier to the target log data, where the first identifier is used to indicate that the corresponding log data is log data to be reviewed.

[0021] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any possible implementation of the first aspect is implemented.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute a method as described in the first aspect or any possible implementation method of the first aspect.

[0024] In an embodiment of the present application, log data is obtained, and a question set corresponding to the log data is generated based on the log data, the question set including one or more of a first question generated by log interpretation of the log data, a second question generated by log risk analysis of the log data, and a third question generated by threat assessment of the log data, and finally, answer data is generated based on the log data and the question set to obtain corpus data corresponding to the log data.

[0025] That is to say, the embodiments of the present application can perform log interpretation, log risk analysis and threat assessment on log data, and generate questions and answer data related to log interpretation, log risk analysis and threat assessment, that is, more comprehensive corpus data can be generated through the embodiments of the present application. In addition, the strategy of generating question and answer data separately helps to reduce the correlation between the generated question and answer data, thereby improving the accuracy of the generated corpus data. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0027] Figure 1 A schematic diagram of possible application scenarios provided for embodiments of the present application;

[0028] Figure 2 A flowchart of a method for generating corpus data provided in an embodiment of the present application;

[0029] Figure 3 A flowchart for completing the attack sample data that is less in number or missing in the second log set provided in an embodiment of the present application;

[0030] Figure 4 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0031] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0033] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0034] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0035] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0036] In recent years, with the continuous development of artificial intelligence technology, noise reduction processing of log alarm information based on large language model technology has gradually become a research hotspot. The large language model can automatically identify and filter low-priority or repeated log alarm information by learning and analyzing massive log data. Among them, identifying and filtering low-priority or repeated log alarm information can also be understood as noise reduction processing of log alarm information, and the accuracy of the large language model's noise reduction processing of log alarm information is related to the corpus data used to optimize the large language model. How to improve the comprehensiveness of the corpus data is a technical problem that needs to be solved urgently.

[0037] In view of this, an embodiment of the present application provides a corpus data generation method for improving the comprehensiveness of corpus data. In an embodiment of the present application, after obtaining the log data, the log data can be subjected to log interpretation, log risk analysis, and threat assessment, and questions and answer data related to log interpretation, log risk analysis, and threat assessment can be generated. That is, through an embodiment of the present application, the tasks involved in log analysis can be divided into multiple tasks, and corpus data corresponding to the log data can be generated according to the task type, which helps to improve the comprehensiveness of the corpus data. In addition, the questions and answer data in the embodiment of the present application are generated separately, which can reduce the probability of mutual interference between the generated questions and answer data, thereby improving the accuracy of the generated corpus data.

[0038] After introducing the main inventive ideas of the embodiments of the present application, the specific implementation of the corpus data generation method proposed in the embodiments of the present application will be introduced below through some specific embodiments and drawings.

[0039] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0040] Please refer to Figure 1 , which is a schematic diagram of a possible application scenario provided in an embodiment of the present application. In this scenario, a terminal device 101 and a server 102 may be included.

[0041] The terminal device 101 may be a mobile phone, a tablet computer (PAD), a personal computer (PC), a wearable device, a vehicle-mounted terminal, etc. The server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0042] The terminal device 101 and the server 102 may be directly or indirectly connected to each other through one or more communication networks 103. The communication network 103 may be a wired network or a wireless network, for example, a mobile cellular network or a wireless fidelity (Wireless-Fidelity, WIFI) network, or other possible networks, which are not limited in the embodiment of the present invention.

[0043] The corpus data generation method in the embodiment of the present application can be executed by a computer device, which can be a terminal device 101 or a server 102. Taking the execution of the corpus data generation method by the server 102 as an example, the server 102 includes a large language model. The server can receive log data from the terminal device 101 through the communication network 103, and generate a question set based on the log data, the question set includes a first question generated by log interpretation of the log data, a second question generated by log risk analysis of the log data, and one or more questions in the third question obtained by threat assessment of the log data, and finally generates answer data based on the question set and the log data to obtain the corpus data corresponding to the log data. Figure 1 The scenarios shown are only examples. In other scenarios, more terminal devices and / or servers may be included, and the embodiments of the present application are not limited to this.

[0044] The following describes the method of cryptographic resource allocation provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this regard.

[0045] Please refer to Figure 2 , is a flow chart of a method for generating corpus data provided in an embodiment of the present application, which method can be Figure 1 The terminal device 101 and / or server 102 shown are executed, and this application does not impose any limitation on this.

[0046] S201: Obtain log data.

[0047] The log data may include, for example, a Uniform Resource Locator (URL), an identifier, a source Internet Protocol (IP) address, a Hypertext Transfer Protocol (HTTP) request method, a request header, a user agent, WAF rule triggering information, an attack type, whether to intercept, and other information.

[0048] The log data may come from a first log set, for example. Therefore, optionally, before obtaining the log data, that is, before executing S201, the first log set may also be obtained. For example, the log data set may be obtained by collecting internal log data and open source shared data sets, and the first log set may be determined based on the log data set.

[0049] Optionally, the manner of determining the first log set according to the log data set may include, for example, the following:

[0050] Method 1: The log data set may be collected as the first log set.

[0051] Method 2: Considering the possibility of duplicate logs and the different types of log data generated by different device types, for example, the formats of log data generated by different device types are different, when the log data set is obtained, the log data set can also be processed, and the log data set obtained after the processing is used as the first log set. For example, the log data set can be cleaned to filter out duplicate log data and log data with irregular formats, and the log data in the log data set obtained by data cleaning can be normalized to unify the formats of log data from different sources (i.e., from different devices), for example, the timestamp format, log level (such as INFO, WARN, ERROR) and other fields of log data from different sources are unified.

[0052] Method 3: Considering that in log analysis, different types of attack sample data are often unbalanced, for example, the number of some types of attack sample data may be extremely scarce or completely missing. Therefore, after the log data set is cleaned, that is, after the log data set is processed by method 2, the missing or small number of attack sample data in the cleaned log data set can be supplemented to obtain the first log set. For example, the log set cleaned by method 2 can be used as the second log set, and the small number or missing attack sample data in the second log set can be supplemented based on the attacker's behavior path deduction (Attack Trajectory Simulation, ATS) model.

[0053] For example, please refer to Figure 3 , which is a flowchart for completing the attack sample data that is small in number or missing in the second log set.

[0054] S301: Classify the log data included in the second log set according to attack type.

[0055] The attack types may include, for example, distributed denial of service (DDoS) attacks, structured query language (SQL) injections, cross-site scripting (XSS) attacks, and directory traversal attacks.

[0056] S302: Determine the target attack type whose log data quantity is less than a threshold.

[0057] S303: Generate target log data corresponding to the target attack type according to the attack feature of the target attack type.

[0058] The key features of the target attack type are extracted according to the log data belonging to the target attack type included in the second log set. Taking the target attack type as DDoS attack as an example, the extracted key features of the DDoS attack may be, for example, an abnormally high traffic peak value; taking the target attack type as SQL injection as an example, the extracted key features of the SQL injection may be, for example, a SQL code fragment included in the URL, etc.

[0059] After obtaining the key features of the target attack type, the attack sample corresponding to the target attack type can be constructed based on the key features. For example, if the target attack type is a DDoS attack, a high-traffic DDoS attack log can be generated; if the target attack type is a SQL injection, an HTTP request log containing the SQL injection code can be generated.

[0060] Among them, constructing attack samples according to key features can be achieved, for example, through a large language model, that is, the attack samples corresponding to the target attack type can be constructed according to the key features through a large language model.

[0061] After obtaining the attack sample corresponding to the target attack type, the attack behavior path can be deduced using the large language model corresponding to the target attack type. Taking the target attack type as directory traversal as an example, after obtaining the attack sample data of directory traversal, the attack behavior path model of directory traversal can be used to deduce the attack behavior path to generate the target log data corresponding to the target attack type.

[0062] Optionally, before using the directory traversal attack behavior path model to deduce the attack behavior path, the directory traversal attack behavior path model may also be obtained. The process of obtaining the directory traversal attack behavior path model includes the following three stages:

[0063] Phase 1: By analyzing historical attack data and security expert knowledge, a directory traversal attack behavior path model is established. The directory traversal attack behavior path model can include the following processes:

[0064] Initial intrusion: Bypass the server's restrictions on file access by entering special characters or paths (such as .. / ) to try to access unauthorized system files.

[0065] File information acquisition: When the initial intrusion bypasses the server's restrictions on file access, access sensitive configuration files or obtain a list of core files of the system, such as password files ( / etc / passwd), log files, etc.

[0066] Privilege escalation: Accessing specific files or configurations to gain higher privileged user credentials or exploit system configuration errors to gain further control over the system.

[0067] Data theft: Using elevated privileges to access sensitive data and download or steal those files.

[0068] Phase 2: Use the directory traversal attack behavior path model established in Phase 1 to deduce the attack path and generate multiple continuous attack event logs. The attack path deduction may include the following stages:

[0069] Initial compromise phase: Generates logs of directory traversal attack attempts, such as entering .. / etc / passwd in the URL to try to access system files.

[0070] File information acquisition phase: Logs record the contents of sensitive files that are successfully read, or lists the files in a directory, such as access to server configuration files or user password files.

[0071] Privilege escalation phase: Obtain information about users with higher privileges and generate logs that use this information to escalate privileges.

[0072] Data theft phase: Generates logs of file or data download operations obtained after privilege escalation.

[0073] Phase 3: Context correlation generates a complete attack path log.

[0074] That is, when deducing the attack behavior path and generating the attack path log, the contextual relevance of the generated data is maintained so that the data at each stage conforms to the actual attack logic.

[0075] For example, the logs of the initial intrusion should be associated with the logs of access to sensitive files to show that directory traversal provides the possibility of further file access. The logs of file information acquisition should be associated with the logs of privilege escalation to show that higher access rights (such as system management rights after privilege escalation) were obtained by reading files. After privilege escalation, it should be shown how to use higher privileges to access deeper sensitive data or system files to generate logs of data theft.

[0076] S304: Determine that a set formed by the second log set and the target log data is a first log set.

[0077] Optionally, a first identifier may be added to the target log data, and the first identifier is used to indicate that the corresponding log data (i.e., the target log data) is log data to be reviewed, wherein the log data to be reviewed may also be understood as forged log data, i.e., the log data is not log data generated by a real security device. The first identifier may include, for example, relevant information indicating the attack path type, generation time, generation model version, etc.

[0078] Optionally, the log data with the first identifier added may be audited by security experts, for example, to verify whether the attack path complies with the actual attack logic, so as to ensure the authenticity and validity of the forged log data.

[0079] In the above technical solution, by completing the attack sample data that is small in number or missing, not only can the problem of scarce attack sample data be solved, but the attack identification capability of the model can also be enhanced, making it more efficient and accurate when facing diverse security threats.

[0080] S202: Generate a question set based on the log data.

[0081] In an embodiment of the present application, the security tasks involved in log analysis are divided into one or more tasks of log interpretation, log risk analysis, and threat assessment, and the log data is processed based on the one or more tasks to generate a set of questions corresponding to the log data. Taking the division of the security tasks involved in log analysis into log interpretation, log risk analysis, and threat assessment as an example, the log data can be interpreted to generate a first question, the log risk analysis can be performed on the log data to generate a second question, and the threat assessment can be performed on the log data to generate a third question.

[0082] The task of interpreting log data may include one or more of the following subtasks:

[0083] Subtask 1: Parse the request (eg, HTTP request) contained in the log data to determine whether the HTTP request is a normal request or an abnormal request.

[0084] For example, the HTTP request method, request header and other information in the log data can be obtained, and the request frequency, parameter length and other information of the HTTP request can be determined to determine whether the HTTP request is a normal request or an abnormal request. For example, if the request frequency of the HTTP request is greater than the request frequency range (that is, not within the parameter range corresponding to the request frequency), it indicates that the HTTP request is an abnormal request. If the request frequency of the HTTP request is within the parameter range corresponding to the request frequency, it indicates that the HTTP request is a normal request. It can be understood that the parameters used to determine whether a request is a normal request or an abnormal request can also include, for example, a user agent string, etc., which is not limited in the embodiments of the present application.

[0085] Subtask 2: Interpret the fields included in the log data and obtain the log content of the log data.

[0086] The field includes, for example, request time, source IP address, request URL, response status code, threat category, etc. The threat category is, for example, the aforementioned attack type.

[0087] Subtask 3: Obtaining an associated log associated with the log data, and determining an attack behavior of the log data according to the log data and the associated log. The attack behavior may include, for example, an attack behavior across time periods or an attack behavior across requests.

[0088] The three subtasks included in log interpretation can be seen in Table 1.

[0089] Table 1

[0090]

[0091] The task of performing log risk analysis on log data may include one or more of the following subtasks:

[0092] Subtask 1: Analyze the requests (such as HTTP requests) contained in the log data to determine whether the HTTP request is an abnormal request or a normal request. If the HTTP request is an abnormal request, determine the abnormal features corresponding to the HTTP request, and evaluate the risk index of the log data based on the abnormal features.

[0093] For the description of abnormal requests, please refer to the description of abnormal requests in the log interpretation, which will not be repeated here. The abnormal feature can also be understood as abnormal behavior. When determining that the HTTP request is an abnormal request, the abnormal behavior can be further determined based on the request frequency, request parameter length, user agent string, etc. of the HTTP request.

[0094] Subtask 2: Determine the source address (eg, the aforementioned source IP address) corresponding to the request (eg, HTTP request) included in the log data, and evaluate the risk index of the log data based on the source IP address.

[0095] For example, it can be determined whether the source IP address is an IP address in a high-risk area, or whether the source IP address is an address of a known malicious IP segment. If the source IP address is an IP address in a high-risk area or an address of a known malicious IP segment, it indicates that the risk index of the log data is high; if the source IP address is not an IP address in a high-risk area or an address of a known malicious IP segment, it indicates that the risk index of the log data is low.

[0096] Optionally, after the risk index is evaluated, potential risks may be analyzed, that is, the task of performing log risk analysis on log data may also include subtask 3: analyzing potential risks of the log data according to the risk index.

[0097] For example, the attack scope and number of attack targets of the log data can be analyzed, such as whether the log data attacks multiple assets or system components; or the attack complexity of the log data can be analyzed, such as whether the log data uses multiple attacks and uses evasion techniques to bypass protection; or the attack time and attack frequency of the log data can be analyzed. The potential risk of the log data is analyzed based on the analysis results.

[0098] The three subtasks included in log risk analysis can be seen in Table 2.

[0099] Table 2

[0100]

[0101] The task of conducting threat analysis on log data may include one or more of the following subtasks:

[0102] Subtask 1: Identify the attack type of the log data, and determine whether the log data threatens security based on the attack type.

[0103] For example, if it is determined that the log data will cause risks such as business interruption, data loss or data leakage, it indicates that the log data may threaten security. Conversely, if it is determined that the log data will not cause risks such as business interruption, data loss or data leakage, it indicates that the log data may not threaten security.

[0104] Subtask 2: Analyze the behavior characteristics of the requests included in the log data to determine the attack intent and attack target of the log data.

[0105] The behavior characteristics may include, for example, the frequency, time interval, target path, etc. The attack intention may include, for example, data theft, system destruction, or testing of defense mechanisms, etc. The attack target may be, for example, the attacked device (eg, server), etc.

[0106] Subtask 3: Obtaining an associated log associated with the log data, and determining an attack path according to the log data and the associated log.

[0107] Optionally, after determining the attack path, the potential risk of the log data may also be analyzed (or evaluated). For the description of analyzing the potential risk, reference may be made to the description of analyzing the potential risk in subtask 3 of log risk analysis, which will not be repeated here.

[0108] The three subtasks included in threat assessment can be seen in Table 3.

[0109] Table 3

[0110]

[0111]

[0112] Optionally, after performing one or more operations of log interpretation, log risk analysis and threat assessment on the log data, a fourth question can be generated based on one or more of the log interpretation results, log risk analysis results or threat assessment results. The fourth question is related to a disposal suggestion for processing the request included in the log data. The fourth question is also included in the question set.

[0113] Before generating the fourth question, a task of generating a treatment suggestion may be performed. The task of generating a treatment suggestion may include one or more of the following subtasks:

[0114] Subtask 1: Generate automated disposition recommendations.

[0115] The automated disposal suggestion may include, for example, blocking access, updating defense rules (such as updating WAF rules), and enhancing log monitoring, etc. Blocking access may be understood as blocking the access of the log data to the access target.

[0116] Subtask 2: Generate emergency response strategy.

[0117] The emergency response strategy may include, for example, isolating an associated device, generating an alarm message, etc. The associated device is related to a request (for example, an HTTP request) included in the log data, for example, the associated device is an access target of the log data, and the alarm message is used to notify relevant departments or to start an emergency response team to perform emergency processing on the log data.

[0118] Subtask 3: Analyze long-term trends based on the log data and generate optimization suggestions based on the analysis results.

[0119] For example, through long-term trend analysis of log data, changing trends of common threats can be identified, and targeted optimization suggestions can be provided. The optimization suggestions may include regularly updating WAF rules, adjusting firewall policies, and strengthening user training.

[0120] The three subtasks included in generating treatment suggestions can be referred to in Table 4, for example.

[0121] Table 4

[0122]

[0123] Optionally, you can also use Chain-of-Thought (CoT) technology to build a dynamic prompt word library based on the characteristics of different tasks. The prompt word library contains keywords in specific fields, common problem templates, and key terms in logs to ensure the professionalism and accuracy of the generated data. The dynamic prompt word library includes a variety of prompt word templates. The model is guided to gradually deduce problems through the prompt word library and task characteristics. This method ensures that the generated instruction data is more logically consistent and in line with actual scenarios. For example, in the log threat analysis task, CoT reasoning guides the model to infer from abnormal traffic patterns to potential threats, thereby generating high-quality questions. Through the feedback mechanism, the prompt word library and CoT reasoning chain structure will be continuously updated and optimized to ensure that the generated instruction data always meets the latest security requirements and threat scenarios.

[0124] The following is a prompt word template.

[0125] You are an expert in the security field and are good at analyzing and mining key information in device alarms. Your task is to propose two log risk analysis (also known as risk location) questions based on the logs provided and in accordance with the following requirements.

[0126] Require:

[0127] 1. Read the provided log information in detail, analyze the attack type, suspicious parameters, abnormal fields, attack purpose and potential consequences, and simulate the front-line security operations personnel to ask questions from the perspective of risk positioning.

[0128] 2. The generated question set should focus on the security field and be divided into two difficulty levels - low (answerable by junior security practitioners) and high (answerable by senior security practitioners).

[0129] 3. The generated questions should not be repetitive or similar, and do not repeat verbs in each question to maximize diversity.

[0130] 4. Each question must be in Chinese and should be clear and professional. Do not use consecutive question sentences.

[0131] 5. The final output format generated is a standard list of JavaScript Object Notation (JSON), with a length of 10, and each object includes two fields: question and difficulty. The outer double quotes of JSON keys and values ​​remain unchanged. If quotes are required in JSON values, use single quotes instead of double quotes.

[0132] According to the prompt word template, the two risk positioning questions raised are:

[0133] Question 1: "Does the GET request in the log data contain potential XSS attack code?", "Difficulty: Low".

[0134] Question 2: "What are the potential risks of the query parameter %3Cscript% in the log data?", "Difficulty: High".

[0135] S203: Generate answer data according to the log data and the question set, and obtain corpus data corresponding to the log data.

[0136] After obtaining the question corresponding to the log data, the log data can be analyzed based on the question to generate answer data corresponding to each question, and finally the corpus data corresponding to the log data is generated according to the question and the answer data. The corpus data may include fields such as instructions, input and output, attack type, security task, and security device type, and can be used as annotation data for training and optimizing a large language model.

[0137] Optionally, after obtaining the corpus data corresponding to the log data, in order to ensure the accuracy of the large language model reasoning, the generated corpus data can also be governed and quality evaluated based on the idea of ​​human-computer collaboration.

[0138] For example, automated data governance tools can be developed to detect outliers and duplicate records in corpus data, mainly through regular expression analysis, statistical analysis and machine learning algorithms to identify anomalies such as unreasonable timestamps, duplicate IP addresses or abnormally high traffic values.

[0139] The automated data governance tool automatically generates a data governance report after data processing is completed, recording the details of each governance operation, including the type of anomalies detected, deduplication results, and data correction suggestions.

[0140] Considering that high-quality data requires the historical experience and knowledge level of security experts, expert evaluation and feedback can be conducted next. Optionally, considering the huge amount of corpus data and manpower limitations, a data sampling distribution strategy can be adopted to distribute some key corpus data to security experts for manual evaluation. Among them, expert evaluation can, for example, include verifying the correctness of corpus data, identifying potential mislabeling, and making correction suggestions. After the expert evaluation is completed, an evaluation report can be generated to record the correctness of the corpus data, quality score, and correction suggestions.

[0141] In this technical solution, the large language model is continuously optimized by combining the governance report and the evaluation report. For example, the reasoning strategy of the large language model is adjusted according to the evaluation report fed back by experts, or the parameter setting of the anomaly detection algorithm is improved. And through the continuous iteration of human-computer collaboration, it helps to improve the overall quality of the corpus data and ensure the accuracy and reliability of the corpus data.

[0142] Based on the same inventive concept, an embodiment of the present application also provides a communication device.

[0143] See also Figure 4 , a structural schematic diagram of a communication device is provided for an embodiment of the present application. The communication device may be the above-mentioned terminal device or server, or a chip or integrated circuit in the terminal device or server, etc. The device includes a module / unit / technical means for executing the method performed by the terminal device 101 in the above-mentioned method embodiment.

[0144] Exemplarily, the communication device includes:

[0145] The acquisition module 401 is used to acquire log data;

[0146] Processing module 402 is used to generate a question set based on the log data, the question set including: one or more of a first question generated by performing log interpretation on the log data, a second question generated by performing log risk analysis on the log data, and a third question generated by performing threat assessment on the log data; and, generate answer data based on the log data and the question set to obtain corpus data corresponding to the log data.

[0147] In one possible implementation, the processing module 402 is used to interpret the log data in one or more of the following ways: parsing the request contained in the log data to determine whether the request is a normal request or an abnormal request, and the request frequency and / or parameter length of the abnormal request is not within the corresponding parameter range; interpreting the fields included in the log data to obtain the log content of the log data; or obtaining an associated log associated with the log data, and determining the attack behavior of the log data based on the log data and the associated log, the attack behavior including attack behavior across time periods or attack behavior across requests.

[0148] In one possible implementation, the processing module 402 is used to perform log risk analysis on the log data in the following manner: analyzing the requests contained in the log data to determine whether the request is an abnormal request or a normal request; when the request is an abnormal request, determining abnormal features corresponding to the request, and evaluating the risk index of the log data based on the abnormal features, the request frequency and / or parameter length of the abnormal request are not within the corresponding parameter range; and / or determining the source address corresponding to the request included in the log data, and evaluating the risk index of the log data based on the source address.

[0149] In one possible implementation, the processing module 402 is used to perform threat analysis on the log data in one or more of the following ways: identifying the attack type of the log data, and determining whether the log data will threaten security based on the attack type; analyzing the behavioral characteristics of the requests included in the log data, and determining the attack intent and attack target of the log data; or, obtaining associated logs associated with the log data, and determining the attack path based on the log data and the associated logs.

[0150] In a possible implementation, the processing module 402 is also used to generate a fourth question based on one or more results of the log interpretation, log risk analysis, and threat assessment, wherein the fourth question is related to a disposal suggestion for processing the request included in the log data, and the question set also includes the fourth question.

[0151] In a possible implementation, the handling suggestion includes one or more of the following: blocking access; updating defense rules; enhancing log monitoring; isolating associated devices, which are related to the request included in the log data; or generating alarm information.

[0152] In a possible implementation, the log data comes from a first log set, and the acquisition module 401 is further used to: acquire a second log set; the processing module 402 is further used to: classify the log data included in the second log set according to attack type; determine a target attack type whose log data quantity is less than a threshold; generate target log data corresponding to the target attack type according to attack characteristics of the target attack type; and determine that a set formed by the second log set and the target log data is the first log set.

[0153] In a possible implementation manner, the processing module 402 is further used to: add a first identifier to the target log data, where the first identifier is used to indicate that the corresponding log data is log data to be reviewed.

[0154] As an example, Figure 4 The communication device can be used to perform Figure 2 Therefore, for the functions that can be realized by each functional module of the communication device, reference can be made to Figure 2 The description of the illustrated embodiment will not be repeated here.

[0155] It should be noted that, although several modules or submodules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be embodied.

[0156] As a possible product form of the above communication device, see Figure 5 The embodiment of the present application further provides an electronic device 500, including:

[0157] At least one processor 501; and a communication interface 503 that is communicatively connected to the at least one processor 501; the at least one processor 501 executes instructions stored in the memory 502, so that the electronic device 500 executes the method steps performed by any device in the above method embodiment through the communication interface 503.

[0158] Optionally, the memory 502 is located outside the electronic device 500 .

[0159] Optionally, the electronic device 500 includes the memory 502, the memory 502 is connected to the at least one processor 501, and the memory 502 stores instructions that can be executed by the at least one processor 501. Figure 5 The dashed lines indicate that the memory 502 is optional for the electronic device 500 .

[0160] The processor 501 and the memory 502 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0161] The specific connection medium between the processor 501, the memory 502 and the communication interface 503 is not limited in the embodiment of the present application. Figure 5 In the embodiment, the processor 501, the memory 502 and the communication interface 503 are connected via a bus 504. Figure 5 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0162] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0163] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0164] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0165] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0166] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method example.

[0167] As another possible product form, an embodiment of the present application also provides a computer program product including instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method steps executed by any device in the above method embodiment.

[0168] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0169] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0172] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for generating corpus data, characterized in that: The method comprises: Get log data; Generate a question set based on the log data, the question set including: one or more of: a first question generated by performing log interpretation on the log data, a second question generated by performing log risk analysis on the log data, and a third question generated by performing threat assessment on the log data; Answer data is generated based on the log data and the question set to obtain corpus data corresponding to the log data.

2. The method according to claim 1, characterized in that Performing log interpretation on the log data includes one or more of the following: Parsing the request contained in the log data to determine whether the request is a normal request or an abnormal request, wherein the request frequency and / or parameter length of the abnormal request is not within a corresponding parameter range; Interpreting the fields included in the log data to obtain the log content of the log data; or, Acquire an associated log associated with the log data, and determine attack behaviors of the log data according to the log data and the associated log, wherein the attack behaviors include attack behaviors across time periods or attack behaviors across requests.

3. The method according to claim 1, characterized in that Performing log risk analysis on the log data, including: Analyze the request contained in the log data to determine whether the request is an abnormal request or a normal request. If the request is an abnormal request, determine the abnormal feature corresponding to the request, and evaluate the risk index of the log data according to the abnormal feature. The request frequency and / or parameter length of the abnormal request are not within the corresponding parameter range; and / or, Determine a source address corresponding to a request included in the log data, and evaluate a risk index of the log data according to the source address.

4. The method according to claim 1, characterized in that Perform threat analysis on the log data, including one or more of the following: Identify the attack type of the log data, and determine whether the log data will threaten security according to the attack type; Analyze the behavior characteristics of the request included in the log data to determine the attack intent and attack target of the log data; or, Obtaining a correlation log associated with the log data, and determining an attack path according to the log data and the correlation log.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: A fourth question is generated based on one or more results of the log interpretation, log risk analysis, and threat assessment. The fourth question is related to a disposal suggestion for processing the request included in the log data. The question set also includes the fourth question.

6. The method according to claim 5, characterized in that The treatment recommendations include one or more of the following: Block access; Updated defense rules; Enhanced log monitoring; isolating an associated device, the associated device being related to the request included in the log data; or, Generates an alarm message.

7. The method according to claim 1, characterized in that The log data comes from a first log set, and the method further includes: Get the second log set; Classifying the log data included in the second log set according to attack type; Determine the target attack type whose log data volume is less than the threshold; Generate target log data corresponding to the target attack type according to the attack characteristics of the target attack type; Determine a set formed by the second log set and the target log data as the first log set.

8. The method according to claim 7, characterized in that The method further comprises: A first identifier is added to the target log data, where the first identifier is used to indicate that the corresponding log data is log data to be reviewed.

9. A communication device, characterized in that: include: Acquisition module, used to obtain log data; a processing module, configured to generate a question set based on the log data, wherein the question set includes one or more of: a first question generated by performing log interpretation on the log data, a second question generated by performing log risk analysis on the log data, and a third question generated by performing threat assessment on the log data; And, generating answer data based on the log data and the question set to obtain corpus data corresponding to the log data.

10. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 8 by executing the instructions stored in the memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 8 is implemented.

Images