LLM-based security report generation method, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an LLM-based security report generation method, electronic equipment and a storage medium, and relates to the technical field of large language models. The method comprises the steps that a task library and a tool library are constructed, and after a generation request of a safety report is received, a corresponding task template is matched from the task library according to the generation request; executing the steps in the task template to obtain a corresponding execution result, and if a certain step includes calling the tool in the tool library, constructing a prompt to submit an operation result returned by calling the tool to the big data model to obtain a corresponding description as the execution result of the step; and after all the steps in the task template are executed, constructing a prompt to provide all the obtained execution results to the large language model, and generating a safety report. According to the embodiment provided by the invention, the safety report generation efficiency and standardization are improved.

Description

Technical Field

[0001] The present application relates to the technical field of large language models, and in particular to a security report generation method based on LLM, an electronic device and a corresponding storage medium. Background Art

[0002] Outputting security reports is an important task in the security field. For example, after a security incident is discovered, a security incident analysis report needs to be generated; the situation awareness system needs to generate weekly, monthly, and annual security situation reports; vulnerability scanning equipment needs to generate vulnerability scanning security analysis reports based on the scanning results. Security reports can enable users to understand the current network security situation more intuitively and systematically, and strengthen their own security based on the relevant tips or security suggestions given in the report.

[0003] The existing security report generation basically relies on manual work or the application of fixed templates. Manual analysis and report output is time-consuming and labor-intensive, and the quality of the report may not be guaranteed due to the uneven technical skills of analysts. The reports generated by applying fixed templates are not easy to read, and the maintenance cost of the templates is high. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a security report generation method, electronic device and storage medium based on LLM, and to provide a framework for automatically generating network security reports through automatic calling tools and LLM through task processes, so as to at least solve some of the problems in the background technology.

[0005] In order to achieve the above-mentioned purpose, the present application provides a security report generation method based on LLM, which includes: constructing a task library, wherein the task library includes a plurality of task templates, and the task template includes the steps of generating a security report; constructing a tool library, wherein the tool library includes a plurality of tools, and the tools are used to perform corresponding operation actions and return operation results; after receiving a request for generating a security report, matching the corresponding task template from the task library according to the generation request; executing the steps in the task template to obtain the corresponding execution results, and if a step includes calling a tool in the tool library, the construction prompt submits the operation result returned by the calling tool to the big data model to obtain the corresponding description as the execution result of the step; after all the steps in the task template are executed, the construction prompt provides all the obtained execution results to the large language model to generate a security report.

[0006] Optionally, the task templates in the task library are written in a specific format, and the specific format includes: a task name, which includes a task type; input parameters, which include necessary parameters for completing the task type; steps, some of which include a data acquisition sub-step, a data parsing sub-step and a data interpretation sub-step; and a report output step based on a large language model.

[0007] Optionally, the call to the tool in the tool library in the step is set in the description of the step in the form of a specific mark plus the tool name; the call to the large language model in the step is set in the description of the step in the form of a construction prompt.

[0008] Optionally, matching a corresponding task template from the task library according to the generation request includes: determining whether the generation request comes from a description mode or a dialogue mode; extracting the task type in the generation request from the description mode, matching in the task library based on the task type, and determining the corresponding task template according to the matching result; vectorizing the natural language of the generation request from the dialogue mode, matching the vectorized data in a preset vector library, and determining the task template according to the matching result; the preset vector library is obtained by vectorizing the task names in the task library.

[0009] Optionally, after selecting a corresponding task template from a task library according to the feature fields in the generation request, the method further includes: displaying the task template to a user; obtaining the user's adjustment operations on the steps in the task template to obtain the adjusted steps; and using the adjusted steps as the steps in the task template.

[0010] Optionally, if a step includes calling a tool in the tool library, the construction prompt submits the operation result returned by the called tool to the big data model to obtain a corresponding description as the execution result of the step, including: if a step includes a string identified by a specific flag, the string is matched in the tool library to obtain a tool that matches the string; the tool that matches the string is executed to obtain return data; the return data is sent to the big language model based on the prompt to generate a corresponding description as the execution result of this step.

[0011] Optionally, the data analysis sub-step is configured to: determine a analysis template based on input parameters of a tool called in the next step of the step where the data analysis sub-step is located; generate an analysis result based on the return data obtained by executing the tool in the step where the data analysis sub-step is located and the analysis template, and the analysis result serves as an input parameter of the tool called in the next step.

[0012] Optionally, the tool library is also configured to: update the tool library based on deletion, modification, and addition instructions input by the user; when the tool library receives a deletion instruction, search the task library with the deleted tool name, and prompt the user with the task template affected by the deletion; when the tool library receives a modification instruction, search the task library with the modified tool name, and prompt the user with the task template affected by the modification; when the tool library receives an addition instruction, search the tool library with the modified tool name, and prompt the user with the tool affected by the addition.

[0013] The present application also provides a security report generation device based on LLM, which includes: a task library construction module, which is used to construct a task library, wherein the task library includes a plurality of task templates, and the task template includes the steps of generating a security report; a tool library construction module, which is used to construct a tool library, wherein the tool library includes a plurality of tools, and the tools are used to perform corresponding operation actions and return operation results; a request matching module, which is used to match the corresponding task template from the task library according to the generation request after receiving a request for generating a security report; an execution description module, which is used to execute the steps in the task template and obtain the corresponding execution results. If a step includes calling a tool in the tool library, the construction prompt submits the operation result returned by the calling tool to the big data model to obtain the corresponding description as the execution result of the step; and a result generation module, which is used to provide all the obtained execution results to the large language model after all the steps in the task template are executed to generate a security report.

[0014] The present application also provides an electronic device, comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the aforementioned LLM-based security report generation method by executing the instructions stored in the memory.

[0015] The present application also provides a machine-readable storage medium on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the aforementioned LLM-based security report generation method.

[0016] The present application also provides a computer program product, including a computer program, which implements the aforementioned LLM-based security report generation method when executed by a processor.

[0017] The above technical solution has the following beneficial effects:

[0018] (1) The task library and tool library are defined. Based on the task library, the corresponding task templates are defined according to the type of report to be generated. The tool library is used to implement tool calls during the execution process, which improves the standardization of safety report generation.

[0019] (2) Using a large language model to generate security reports improves the efficiency of report generation and saves human resources.

[0020] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0022] Figure 1 The following schematically shows the steps of the method for generating a security report based on LLM according to an embodiment of the present application;

[0023] Figure 2 The schematic diagram shows the structure of the LLM-based security report generation device according to the implementation mode of the present application;

[0024] Figure 3 The internal structure of an electronic device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0025] The specific implementation of the embodiment of the present application is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present application, and is not used to limit the embodiment of the present application.

[0026] Figure 1 The schematic diagram of the steps of the method for generating a security report based on LLM in the embodiment of the present application is shown schematically. Figure 1 As shown, a method for generating a safety report based on LLM, the method comprising:

[0027] S01, constructing a task library, wherein the task library includes a plurality of task templates, and the task template includes a step of generating a safety report;

[0028] S02, constructing a tool library, wherein the tool library includes a plurality of tools, and the tools are used to execute corresponding operation actions and return operation results;

[0029] S03, after receiving a request for generating a safety report, matching a corresponding task template from the task library according to the request for generating the safety report;

[0030] S04, executing the steps in the task template to obtain corresponding execution results. If a step includes calling a tool in the tool library, the construction prompt submits the operation result returned by the calling tool to the big data model to obtain a corresponding description as the execution result of the step;

[0031] S05. After all the steps in the task template are executed, a prompt is constructed to provide all the obtained execution results to the large language model to generate a security report.

[0032] In the actual implementation process, the execution order of S01 and S02 can be exchanged, that is, the tool library is built first, and then the task library is built. In addition, although S01 and S02 are the basis of subsequent steps, the tool library and task library can be used repeatedly after being built once, so it does not mean that S01 and S02 need to be executed first every time S03 to S05 are executed.

[0033] Among them, the task templates in the task library are identified by task types, which are different types of security reports, such as security incident reports, vulnerability scanning reports, log audit reports, situation awareness reports, etc.

[0034] The tools in the tool library are built based on the data required in the report. For example, to generate a security incident report, you first need to query the basic information of the incident. Then the basic information of the incident can be used as a tool. The tool is named Incident Search. The tool can query the basic information of the incident based on the incident ID and return the basic information in the form of JSON data. According to the above steps, you can build tools for querying vulnerabilities, querying intelligence, querying logs, etc.

[0035] In step S04, after the corresponding task template is retrieved from the task library, the steps in the selected task template task are executed step by step. When there is a character string in the step that matches the tool name in the task library, the tool is called. For example, when [IOC Search] exists in Stepn, the IOC Search tool in the tool library is called, and the data returned by the tool is provided to LLM to generate a report. Step S05 generates a complete security report after all steps are executed as feedback to the request to generate the security report.

[0036] Through the above implementation, the problem of automatic generation of network security related reports is solved. With the help of the understanding, reasoning and generation capabilities of the large language model, security reports are automatically generated, the efficiency of security report generation is improved, and human resources are saved. At the same time, this implementation also introduces a tool library and tool call, provides a standardized tool for data acquisition of network security related reports, and simplifies the content of the task template.

[0037] In some embodiments of the present application, the task template in the task library is written in a specific format, and the specific format includes: task name, the task name includes the task type; input parameters, including the necessary parameters for completing the task type; steps, some steps include data acquisition sub-steps, data parsing sub-steps and data interpretation sub-steps; and report output steps based on large language models. Exemplarily, the task template format in the task library is introduced by taking the generation of a security incident report as an example. The content in [*] is the tool name, corresponding to the tool library, as follows:

[0038] Task name: Generate security incident report

[0039] Input parameter: event ID

[0040] Step 1-1: [Incident Search] Query the basic information of the incident, such as name, behavior, severity level, first discovery time, last update time, etc., and call the incident query tool;

[0041] Step 1-2: Build a prompt to send the data obtained in Step 1-1 to the LLM (Large Language Model) to generate a basic description of the event;

[0042] Step 1-3: Analyze the data returned by the tool in Step 1-1 and determine the data types contained;

[0043] Step 2-1: [IOC Search], determine whether the data type parsed in Step 1-3 contains IP, Domain, Hash. If yes, call the tool [IOC Search], which is used to query the intelligence information corresponding to IP, Domain, Hash in the intelligence library and return it in JSON format;

[0044] Step 2-2: Build a prompt to send the data obtained in Step 2-1 to LLM to generate intelligence related information about the event

[0045] Step3-1: [CVE Search]......

[0046] Step 3-2: …

[0047] …

[0048] StepN: Build Prompt to provide the content generated from Step1 to StepN-1 to LLM to generate event summary and disposal suggestions, and output the final report.

[0049] In some embodiments of the present application, the call to the tool in the tool library in the step is set in the description of the step in the form of a specific mark plus the tool name; the call to the large language model in the step is set in the description of the step in the form of a constructed prompt. For example, the specific mark is [], [Incident Search], [IOC Search] are the specific mark plus the tool name. The call to the large language model adopts the Prompt method. Prompt is an instruction or question provided to the model when interacting with the large language model, which is used to guide the model to generate specific answers or content. By writing a suitable Prompt, the large language model can be guided to generate expected responses or complete specific tasks. In conversations or when generating text, the design of Prompt is very important for obtaining accurate and satisfactory model responses.

[0050] In some embodiments of the present application, matching the corresponding task template from the task library according to the generation request includes: judging whether the generation request comes from the description mode or the dialogue mode; extracting the task type in the generation request from the description mode, matching in the task library based on the task type, and determining the corresponding task template according to the matching result; vectorizing the natural language of the generation request from the dialogue mode, matching the vectorized data in the preset vector library, and determining the task template according to the matching result; the preset vector library is obtained by vectorizing the task name in the task library. This embodiment provides two task retrieval methods. The dialogue mode is similar to a dialogue mode, and the user obtains the report by describing it in natural language. This method needs to be solved by the vector library. All the task name fields in the task library are vectorized and stored in the vector library. The user's request to generate a report is vectorized and the similarity is calculated with the task name field in the vector library. The highest similarity is selected, and the parameters are obtained from the user's input according to the input parameter field in the task. The description mode directly and completely obtains the description of the user's required security report, and determines the task type in the generation request according to the description of the generation request. This method directly selects the corresponding task template. The two modes provided in this implementation enrich the user input channels and achieve flexible processing of user input.

[0051] In some embodiments of the present application, after selecting the corresponding task template from the task library according to the feature fields in the generation request, the method further includes: displaying the task template to the user; obtaining the user's adjustment operation on the steps in the task template to obtain the adjusted steps; and using the adjusted steps as the steps in the task template. This embodiment provides for the modification of existing task templates, allowing users to adaptively modify task templates according to different scenarios. The task library proposed in this embodiment is constructed based on various report generation scenarios, and can be adjusted in a timely manner according to the update of the scenarios, with high flexibility and low maintenance costs.

[0052] In some embodiments of the present application, if a certain step includes calling a tool in the tool library, a prompt is constructed to submit the operation result returned by the calling tool to the big data model, and a corresponding description is obtained as the execution result of the step, including: if a certain step includes a string identified by a specific mark, the string is matched in the tool library to obtain a tool matching the string; the tool matching the string is executed to obtain return data; the return data is sent to the big language model based on the prompt to generate a corresponding description as the execution result of this step. Taking the aforementioned task template as an example, if Step1-1 has an Incident Search identified by [], then the Incident Search in the tool library is executed to obtain return data. And in Step1-2, a prompt is constructed to send the data obtained by the query in Step1-1 to the LLM to generate a basic description of the event.

[0053] In some embodiments of the present application, the data parsing sub-step is configured as follows: determining a parsing template according to the input parameters of the tool called in the next step of the step where the data parsing sub-step is located; generating a parsing result based on the return data obtained by executing the tool in the step where the data parsing sub-step is located and the parsing template, and the parsing result serves as the input parameter of the tool called in the next step. Please refer to Step 1-3 of the aforementioned task template, which belongs to the data parsing sub-step. It can be seen that its function is to parse the tool return data in Step 1-1 and determine the data type contained therein. The data type here is what is needed in the next step [IOC Search], that is, the parsing template. IP, Domain, and Hash in this data type are used as input parameters in step Step 2-1.

[0054] In some embodiments of the present application, the tool library is further configured to: update the tool library based on the deletion, modification, and addition instructions input by the user; when the tool library receives a deletion instruction, it searches the task library with the deleted tool name, and prompts the user with the task template affected by the deletion; when the tool library receives a modification instruction, it searches the task library with the modified tool name, and prompts the user with the task template affected by the modification; when the tool library receives an addition instruction, it searches the tool library with the modified tool name, and prompts the user with the tool affected by the addition. This embodiment provides an update strategy for the tool library, and the user can delete, modify, and add the tool library according to needs. The update strategy also provides a trigger mechanism to prevent the operation of the task template from failing due to improper update operations.

[0055] Through the above implementation methods, the problem of automatic generation of network security related reports is solved. With the help of the understanding, reasoning and generation capabilities of the large language model, security reports are automatically generated, the efficiency of security report generation is improved, and human resources are saved. At the same time, it also provides flexible adjustment of task templates and flexible update of tool libraries, which is conducive to users' modification and use in different scenarios.

[0056] Based on the same inventive concept, the present application also provides a security report generation device based on LLM. Figure 2 The schematic diagram shows the structure of the device for generating a safety report based on LLM according to the embodiment of the present application. Figure 2 As shown, the device comprises:

[0057] A task library construction module is used to construct a task library, which includes a number of task templates, and the task templates include the steps of generating a security report; a tool library construction module is used to construct a tool library, which includes a number of tools, and the tools are used to perform corresponding operation actions and return operation results; a request matching module is used to match the corresponding task template from the task library according to the generation request after receiving the generation request of the security report; an execution description module is used to execute the steps in the task template and obtain the corresponding execution results. If a step includes calling a tool in the tool library, the construction prompt will submit the operation result returned by the calling tool to the big data model to obtain the corresponding description as the execution result of the step; a result generation module is used to provide all the execution results obtained to the large language model after all the steps in the task template are executed to generate a security report.

[0058] In some optional embodiments of the present application, the task templates in the task library are written in a specific format, and the specific format includes: a task name, which includes a task type; input parameters, including necessary parameters for completing the task type; steps, some of which include a data acquisition sub-step, a data parsing sub-step and a data interpretation sub-step; and a report output step based on a large language model.

[0059] In some optional implementations of the present application, the call to the tool in the tool library in the step is set in the description of the step in the form of a specific mark plus the tool name; the call to the large language model in the step is set in the description of the step in the form of a construction prompt.

[0060] In some optional embodiments of the present application, matching a corresponding task template from the task library according to the generation request includes: determining whether the generation request comes from a description mode or a dialogue mode; extracting the task type in the generation request from the description mode, matching the task type in the task library based on the task type, and determining the corresponding task template according to the matching result; vectorizing the natural language of the generation request from the dialogue mode, matching the vectorized data in a preset vector library, and determining the task template according to the matching result; the preset vector library is obtained by vectorizing the task name in the task library.

[0061] In some optional embodiments of the present application, after selecting a corresponding task template from a task library according to the feature fields in the generation request, the method further includes: displaying the task template to a user; obtaining the user's adjustment operations on the steps in the task template to obtain the adjusted steps; and using the adjusted steps as the steps in the task template.

[0062] In some optional embodiments of the present application, if a step includes calling a tool in the tool library, the construction prompt submits the operation result returned by the called tool to the big data model to obtain a corresponding description as the execution result of the step, including: if a step includes a string identified by a specific flag, the string is matched in the tool library to obtain a tool that matches the string; the tool that matches the string is executed to obtain return data; the return data is sent to the big language model based on the prompt to generate a corresponding description as the execution result of this step.

[0063] In some optional embodiments of the present application, the data analysis sub-step is configured to: determine a analysis template based on the input parameters of a tool called in the next step of the step where the data analysis sub-step is located; generate an analysis result based on the return data obtained by executing the tool in the step where the data analysis sub-step is located and the analysis template, and the analysis result serves as the input parameter of the tool called in the next step.

[0064] In some optional embodiments of the present application, the tool library is further configured to: update the tool library based on deletion, modification, and addition instructions input by the user; when the tool library receives a deletion instruction, search the task library with the deleted tool name, and prompt the user with the task template affected by the deletion; when the tool library receives a modification instruction, search the task library with the modified tool name, and prompt the user with the task template affected by the modification; when the tool library receives an addition instruction, search the tool library with the modified tool name, and prompt the user with the tool affected by the addition.

[0065] The specific definition of each functional module in the above-mentioned LLM-based security report generation device can refer to the definition of the LLM-based security report generation method above, which will not be repeated here. Each module in the above-mentioned system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. It also realizes the advantages of automatically generating security reports with the generation capability, improving the efficiency of security report generation, saving human resources, etc.

[0066] In some embodiments of the present application, the implementation steps in the present application can be set to be automatically executed on a periodic basis, and can be applied to the generation of daily situation reports, weekly situation reports, annual situation reports, etc. in the situation awareness system. Its execution process includes: 1. Build a task library and a tool library according to the content that needs to be included in the situation awareness report. 2. Select the corresponding task in the task library according to the type of situation awareness report that needs to be generated. 3. Execute the selected task process to generate a situation awareness report.

[0067] In some embodiments of the present application, an electronic device is also provided, comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the aforementioned LLM-based security report generation method. Its internal structure diagram can be as follows Figure 3 shown. Figure 3The internal structure diagram of an electronic device according to an embodiment of the present application is schematically shown. The electronic device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected via a system bus. Among them, the processor A01 of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The network interface A02 of the electronic device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a security report generation method based on LLM is implemented.

[0068] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0069] In one embodiment provided in the present application, a machine-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the aforementioned LLM-based security report generation method.

[0070] In one embodiment provided in the present application, a computer program product is provided, including a computer program, which implements the aforementioned LLM-based security report generation method when executed by a processor.

[0071] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0072] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0073] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0074] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0075] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0076] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0077] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0078] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0079] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for generating a safety report based on LLM, characterized in that: The method includes: Building a task library, wherein the task library includes a plurality of task templates, and the task template includes a step of generating a safety report; Constructing a tool library, wherein the tool library includes a plurality of tools, wherein the tools are used to execute corresponding operation actions and return operation results; After receiving a request for generating a safety report, matching a corresponding task template from the task library according to the request for generating the safety report; Execute the steps in the task template to obtain corresponding execution results. If a step includes calling a tool in the tool library, the construction prompt submits the operation result returned by the calling tool to the big data model to obtain a corresponding description as the execution result of the step; After all the steps in the task template are executed, the construction prompt provides all the obtained execution results to the large language model to generate a security report.

2. The method according to claim 1, characterized in that The task templates in the task library are written in a specific format, which includes: Task name, where the task name includes the task type; Input parameters, including those necessary to complete the task type; Steps, some of which include a data acquisition sub-step, a data analysis sub-step and a data interpretation sub-step; and Report output steps based on large language model.

3. The method according to claim 2, characterized in that The calling of the tool in the tool library in the step is set in the description of the step in the form of a specific mark plus the tool name; The call to the large language model in the step is set in the description of the step in the form of a construction prompt.

4. The method according to claim 1, characterized in that: Matching a corresponding task template from the task library according to the generation request includes: Determining whether the generation request is from a description mode or a dialogue mode; Extracting a task type from a generation request of a description mode, matching the task type in the task library, and determining a corresponding task template according to the matching result; The natural language of the generation request from the dialogue mode is vectorized, the vectorized data is matched in a preset vector library, and the task template is determined according to the matching result; the preset vector library is obtained by vectorizing the task names in the task library.

5. The method according to claim 1, characterized in that After selecting a corresponding task template from a task library according to the feature field in the generation request, the method further includes: Presenting the task template to the user; Acquire the user's adjustment operation on the steps in the task template to obtain the adjusted steps; The adjusted steps are used as the steps in the task template.

6. The method according to claim 2, characterized in that If a step includes calling a tool in the tool library, the build prompt submits the operation result returned by the called tool to the big data model to obtain a corresponding description as the execution result of the step, including: If a step includes a character string identified by a specific mark, the character string is matched in a tool library to obtain a tool matching the character string; Execute the tool matching the string to obtain return data; The returned data is sent to the large language model based on the prompt to generate a corresponding description as the execution result of this step.

7. The method according to claim 6, characterized in that The data parsing sub-step is configured as follows: Determine a parsing template according to input parameters of a tool called in a next step of the step in which the data parsing sub-step is located; A parsing result is generated based on the return data obtained by executing the tool in the step where the data parsing sub-step is located and the parsing template, and the parsing result is used as an input parameter of the tool called in the next step.

8. The method according to claim 1, characterized in that The tool library is also configured to: update the tool library based on deletion, modification, and addition instructions input by the user; When the tool library receives a deletion instruction, it searches the task library with the deleted tool name and prompts the user with the task templates affected by the deletion; When the tool library receives a modification instruction, it searches the task library with the modified tool name and prompts the user with the task template affected by the modification; When the tool library receives an adding instruction, the tool library is searched with the modified tool name, and the user is prompted with the tools affected by the adding.

9. An electronic device, characterized in that: include: at least one processor; a memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the steps of the LLM-based security report generation method described in any one of claims 1 to 8 by executing the instructions stored in the memory.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the LLM-based security report generation method described in any one of claims 1 to 8 are implemented.

11. A computer program product, comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the LLM-based security report generation method described in any one of claims 1 to 8 are implemented.

Images