Network security knowledge reasoning method based on thinking chain

Abstract

The invention belongs to the technical field of computer science, and particularly relates to a thinking chain-based network security knowledge reasoning method, which comprises the following steps of S1, screening network security academic data, and carrying out unified formatting processing on the screened data to obtain a network security data corpus used for large model pre-training; s2, carrying out network security corpus training; carrying out network security corpus training on the basic large model by utilizing a PEFT technology and a FlashAttention 2 technology; s3, performing thinking chain prompt sample design by using the current thinking chain prompt theoretical knowledge; and S4, designing a thinking chain prompting method. According to the method, on the basis of combining an existing large model, a zero sample reasoning method and a few sample reasoning method of a thinking chain are combined, and a network security large model with relatively excellent performance is trained and finely adjusted.

Description

Technical Field

[0001] The present invention belongs to the field of computer science technology, and specifically relates to a network security knowledge reasoning method based on thought chain. Background Art

[0002] Language models have attracted more and more attention in recent years due to their powerful performance in various natural language tasks. In recent research on prompt engineering of large language models, thought chain prompts have been proposed as a way to effectively improve the reasoning ability and accuracy of large language models. With the deepening of research on cyberspace security, the knowledge of cyberspace security disciplines has gradually become more complex and cross-cutting, and researchers need to use more knowledge when conducting some research or development tasks. Therefore, it is necessary to enhance the reasoning ability of large language models in the field of network security and provide better help for researchers to retrieve network security related knowledge.

[0003] If a large language model does not use thought chains, the answers generated by the model are prone to lack of logic and coherence, and the ability to answer complex questions will also decline. Thought chains can help the model reason step by step and solve complex problems. Without the process of step-by-step reasoning of thought chains, the model may perform poorly when handling complex tasks. Without thought chains, the model may output smooth but illogical and wrong results. At the same time, the interpretability of the reasoning results of large models is reduced. Summary of the invention

[0004] The purpose of the present invention is to provide a network security knowledge reasoning method based on thought chain, which can combine the zero-sample reasoning and few-sample reasoning methods of thought chain on the basis of the existing large model, and train and fine-tune a large network security model with relatively excellent performance.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A network security knowledge reasoning method based on thought chain, the method comprising the following steps:

[0007] S1: Screen cybersecurity academic materials, format the screened materials in a unified manner, and obtain cybersecurity data corpus for large model pre-training;

[0008] S2: Conduct cyber security corpus training;

[0009] Use PEFT technology and FlashAttention2 technology to train the basic large model on network security corpus;

[0010] In S2, the specific steps of network security corpus training are as follows:

[0011] S21: First, use PEFT technology to write a pre-training program, parse the pre-training corpus, define the work in the pre-training process, and adjust the dataset path, model configuration, and parameters according to the local configuration;

[0012] S22: Then, the model and tokenizer are initialized, the pre-trained model and tokenizer are loaded, and data preprocessing is performed, so that the model tokenizes and blocks the input text data to prepare training data, and then the model configuration is optimized again;

[0013] S23: Pre-training code quantizes and optimizes the model settings, matches the model vocabulary size and tokenizer, and initializes the model;

[0014] S24: Finally, the training is performed, including continuing the training, evaluating the indicators, and automatically saving the intermediate training results;

[0015] The pre-training program receives the pre-training parameters input by the terminal, and sets the pre-training log output by the terminal;

[0016] Then check whether the corresponding file path contains the checkpoint left over from the last pre-training that was not completed:

[0017] If yes, load the corresponding checkpoint and continue the unfinished pre-training.

[0018] If not, start to initialize the model, first perform word segmentation on the pre-trained corpus, then reconnect all the texts in the pre-trained corpus after word segmentation, and divide the text into text blocks with fixed length;

[0019] After completing the relevant initialization work, enable the gradient checkpoint to save important nodes during the pre-training process, then initialize the trainer, start executing the pre-training program, and output the pre-training log in the terminal.

[0020] S25: During pre-training, FlashAttention2 technology is used to accelerate training and optimize the time complexity of self-attention calculation from O(n 2 ) is reduced to O(n).

[0021] In the standard self-attention calculation, the matrix multiplication in self-attention involves a large number of matrix multiplications, and the complexity of self-attention is O(N 2), the main calculation of the Transformer model is concentrated on the attention calculation, so the application scenarios of the Transformer are limited to the calculation efficiency and complexity of the attention. When the sequence length N is too long, the calculation efficiency of the Transformer model will increase quadratically, so when the input length is too long, the execution efficiency of the model will decrease.

[0022] S3: Design a sample of thought chain prompts using current theoretical knowledge of thought chain prompts;

[0023] In S3, the specific steps of designing the thinking chain prompt sample are as follows:

[0024] S31: First, we will artificially construct examples of thought chain problems in the field of network security;

[0025] S32: Then, chatGPT is used to generate a thought chain answer sample, and the manual question and chatGPT answer are combined into a complete thought chain prompt sample. This process is repeated to construct a certain amount of thought chain prompt samples;

[0026] S33: Then conduct a preliminary experiment on the sample thinking chain prompts to screen out a small number of effective sample thinking chain prompts for subsequent use.

[0027] The sample chain of thought prompts needs to meet the following requirements:

[0028] The questions need to cover the fields of cyberspace security including computer networks, cryptography, databases, blockchain, and network attack and defense;

[0029] The answer needs to include a two- or three-step reasoning process rather than simply outputting the answer.

[0030] S4: Design of thinking chain prompt method.

[0031] The thought chain prompt examples filtered out in S3 are input into the large language model as learning samples for the large model's few-shot reasoning. Then, by adding the "let's think step by step" method at the end of the input question, the zero-shot reasoning of the thought chain prompt method is combined with the few-shot reasoning method.

[0032] The cybersecurity academic materials include four categories of documents in the field of cyberspace security: domestic conferences, academic journals, degree theses and Chinese patents.

[0033] The technical effects achieved by the present invention are:

[0034] The present invention is a network security knowledge reasoning method based on thinking chain. The thinking chain prompting method used by the existing large network security model is relatively simple, mostly simple zero-sample thinking chain prompting, which has limited effect on the enhancement of the reasoning ability of the large model. On the other hand, the influence of simply using thinking chain zero-sample prompting or thinking chain few-sample prompting is greatly limited by the parameter size of the base model used.

[0035] The network security knowledge reasoning method based on thought chain of the present invention gives full play to the reasoning ability of the current large language model, and combines it with the zero-sample and few-sample methods of thought chain reasoning, so that users can better use large models to solve network security problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of the process of an embodiment of the present invention;

[0037] Figure 2 This is a sample example of a network security thinking chain in an embodiment of the present invention;

[0038] Figure 3 It is the reasoning process of the thinking chain of the large model of the embodiment of the present invention combining zero samples and few samples. DETAILED DESCRIPTION

[0039] In order to make the purpose and advantages of the present invention more clearly understood, the present invention is specifically described below in conjunction with embodiments. It should be understood that the following text is only used to describe one or several specific embodiments of the present invention, and does not strictly limit the scope of protection of the specific claims of the present invention.

[0040] like Figure 1-Figure 3 As shown, a network security knowledge reasoning method based on thought chain, the method comprises the following steps:

[0041] S1: Screen cybersecurity academic materials, format the screened materials in a unified manner, and obtain cybersecurity data corpus for large model pre-training;

[0042] S2: Conduct cyber security corpus training;

[0043] Use PEFT technology and FlashAttention2 technology to train the basic large model on network security corpus;

[0044] In S2, the specific steps of network security corpus training are as follows:

[0045] S21: First, use PEFT technology to write a pre-training program, parse the pre-training corpus, define the work in the pre-training process, and adjust the dataset path, model configuration, and parameters according to the local configuration;

[0046] S22: Then, the model and tokenizer are initialized, the pre-trained model and tokenizer are loaded, and data preprocessing is performed, so that the model tokenizes and blocks the input text data to prepare training data, and then the model configuration is optimized again;

[0047] S23: Pre-training code quantizes and optimizes the model settings, matches the model vocabulary size and tokenizer, and initializes the model;

[0048] S24: Finally, the training is performed, including continuing the training, evaluating the indicators, and automatically saving the intermediate training results;

[0049] The pre-training program receives the pre-training parameters input by the terminal, and sets the pre-training log output by the terminal;

[0050] Then check whether the corresponding file path contains the checkpoint left over from the last pre-training that was not completed:

[0051] If yes, load the corresponding checkpoint and continue the unfinished pre-training.

[0052] If not, start to initialize the model, first perform word segmentation on the pre-trained corpus, then reconnect all the texts in the pre-trained corpus after word segmentation, and divide the text into text blocks with fixed length;

[0053] After completing the relevant initialization work, enable the gradient checkpoint to save important nodes during the pre-training process, then initialize the trainer, start executing the pre-training program, and output the pre-training log in the terminal.

[0054] S25: During pre-training, FlashAttention2 technology is used to accelerate training and optimize the time complexity of self-attention calculation from O(n 2 ) is reduced to O(n).

[0055] In the standard self-attention calculation, the matrix multiplication in self-attention involves a large number of matrix multiplications, and the complexity of self-attention is O(N 2 ), the main calculation of the Transformer model is concentrated on the attention calculation, so the application scenarios of the Transformer are limited to the calculation efficiency and complexity of the attention. When the sequence length N is too long, the calculation efficiency of the Transformer model will increase quadratically, so when the input length is too long, the execution efficiency of the model will decrease.

[0056] S3: Design a sample of thought chain prompts using current theoretical knowledge of thought chain prompts;

[0057] In S3, the specific steps of designing the thinking chain prompt sample are as follows:

[0058] S31: First, we will artificially construct examples of thought chain problems in the field of network security;

[0059] S32: Then, chatGPT is used to generate a thought chain answer sample, and the manual question and chatGPT answer are combined into a complete thought chain prompt sample. This process is repeated to construct a certain amount of thought chain prompt samples;

[0060] S33: Then conduct a preliminary experiment on the sample thinking chain prompts to screen out a small number of effective sample thinking chain prompts for subsequent use.

[0061] The sample chain of thought prompts needs to meet the following requirements:

[0062] The questions need to cover the fields of cyberspace security including computer networks, cryptography, databases, blockchain, and network attack and defense;

[0063] The answer needs to include a two- or three-step reasoning process rather than simply outputting the answer.

[0064] Then, we conducted a preliminary experiment on the chain of thought prompts to screen out the chain of thought prompts that can enhance the network security reasoning ability of the large language model. After obtaining the chain of thought prompts with good tuning effects through the preliminary experiment, we will input these prompts into the large model in step 4 to enhance the reasoning ability of the large model.

[0065] For a certain ability area, only about 10 thought chain prompt examples need to be designed to significantly enhance the ability of the large language model. Therefore, in this step, we need to screen out about 10 prompt examples that are beneficial to the reasoning of the large model through a pre-experiment of thought chain prompt examples.

[0066] For example, 50 thought chain prompt samples can be artificially designed first, and then the thought chain prompt samples are tested one by one, and 10 thought chain prompt samples that are beneficial to the large language model are screened out. In order to facilitate the subsequent pre-experimental effect evaluation, the reasoning questions used in the pre-experimental stage of the present invention are 10 multiple-choice questions that require explanations for the answers. The large model will accept the input of questions and four options from option A to option D, and output answers after reasoning. During the pre-experimental process, the large language model separately accepts the input of 50 thought chain prompt samples, and then answers 10 reasoning questions in the field of cyberspace security one by one. After each round of accepting the input of a single thought chain prompt sample and fully answering 10 reasoning questions, the experimenter will evaluate the answer effect of the large language model.

[0067] The present invention divides the evaluation of the answering effect of the large language model into two indicators, namely, the completeness and accuracy of the reasoning process, which we record here as φ, where φ takes a value of 0 to 10 and is scored manually; and the correctness of the final answer, which we record here as θ, where θ takes a value of 0 to 10, and the initial value of θ is 0. The value of θ increases by one every time the large language model answers a question correctly. Since φ is manually evaluated and is highly subjective, the differences in evaluations by different people may be large. In order to ensure the objectivity of the preliminary experiment, the present invention decides to set its proportion in the final evaluation to be lower, and the weight coefficient is set to 0.2. θ is only related to whether the results of the multiple-choice questions are correct. Similarly, in order to ensure the objectivity of the experiment, the present invention decides to set the proportion of θ in the final evaluation to be higher, and the weight coefficient is set to 0.8. The final evaluation score is:

[0068] score=0.2×φ+0.8×θ

[0069] The evaluation score score ranges from 0 to 10. According to the corresponding evaluation indicators, the present invention tests 50 thought chain prompt samples and calculates the evaluation scores. Since there are four options in a single-choice question, the accuracy should be close to 25% in the case of random selection. Therefore, we set θ=2.5 as our evaluation benchmark. After the large language model uses the thought chain prompt sample, θ of answering the 10 pre-experimental questions should be at least 3, otherwise the thought chain sample will be excluded. Since we have previously put forward the following requirements for the thought chain prompt samples: (1) The retained thought chain prompt samples need to cover all areas of cyberspace security, including computer networks, cryptography, databases, blockchains, network attacks and defenses, etc.; (2) The answer needs to include two to three steps of reasoning process, rather than simply outputting the answer, so we hope that after the data results of the pre-experiment, at least two thought chain prompt samples will be retained in each subdivision field as a template for the answer.

[0070] Examples of the 10 test questions used in this pilot experiment are shown in Table 1.

[0071] Table 1 Examples of pre-experimental test questions

[0072]

[0073]

[0074] S4: Design of thinking chain prompt method.

[0075] We use the thought chain prompt samples selected from S3 and input them into the large language model as learning samples for the large model's few-sample reasoning. Then, by adding the "let's think step by step" method at the end of the input question, we combine the zero-sample reasoning of the thought chain prompt method with the few-sample reasoning method. This method can maximize the reasoning ability of the large language model in the field of network security.

[0076] The cybersecurity academic materials include four categories of documents in the field of cyberspace security: domestic conferences, academic journals, degree theses and Chinese patents.

[0077] The above is only a preferred embodiment of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the protection scope of the present invention. The structures, devices and operating methods not specifically described and explained in the present invention shall be implemented according to the conventional means in the art unless otherwise specified and limited.

Claims

1. A network security knowledge reasoning method based on thought chain, characterized by: The method comprises the following steps: S1: Screen cybersecurity academic materials, format the screened materials in a unified manner, and obtain cybersecurity data corpus for large model pre-training; S2: Conduct cyber security corpus training; Use PEFT technology and FlashAttention2 technology to train the basic large model on network security corpus; S3: Design a sample of thought chain prompts using current theoretical knowledge of thought chain prompts; S4: Design of thinking chain prompt method.

2. According to claim 1, a network security knowledge reasoning method based on thought chain is characterized by: In S2, the specific steps of network security corpus training are as follows: S21: First, use PEFT technology to write a pre-training program, parse the pre-training corpus, define the work in the pre-training process, and adjust the dataset path, model configuration, and parameters according to the local configuration; S22: Then, the model and tokenizer are initialized, the pre-trained model and tokenizer are loaded, and data preprocessing is performed, so that the model tokenizes and blocks the input text data to prepare training data, and then the model configuration is optimized again; S23: Pre-training code quantizes and optimizes the model settings, matches the model vocabulary size and tokenizer, and initializes the model; S24: Finally, the training is performed, including continuing the training, evaluating the indicators, and automatically saving the intermediate training results; S25: During pre-training, FlashAttention2 technology is used to accelerate training and optimize the time complexity of self-attention calculation from O(n 2 ) is reduced to O(n).

3. According to claim 2, a network security knowledge reasoning method based on thought chain is characterized by: The pre-training program receives the pre-training parameters input by the terminal, and sets the pre-training log output by the terminal; Then check whether the corresponding file path contains the checkpoint left over from the last pre-training that was not completed: If yes, load the corresponding checkpoint and continue the unfinished pre-training. If not, start to initialize the model, first perform word segmentation on the pre-trained corpus, then reconnect all the texts in the pre-trained corpus after word segmentation, and divide the text into text blocks with fixed length; After completing the relevant initialization work, enable the gradient checkpoint to save important nodes during the pre-training process, then initialize the trainer, start executing the pre-training program, and output the pre-training log in the terminal.

4. According to claim 2, a network security knowledge reasoning method based on thought chain is characterized by: In S25, in the standard self-attention calculation, the matrix multiplication in the self-attention includes a large number of matrix multiplications, and the complexity of the self-attention is O(N 2 ), the main calculation of the Transformer model is concentrated on the attention calculation, so the application scenarios of the Transformer are limited to the calculation efficiency and complexity of the attention. When the sequence length N is too long, the calculation efficiency of the Transformer model will increase quadratically, so when the input length is too long, the execution efficiency of the model will decrease.

5. According to claim 1, a network security knowledge reasoning method based on thought chain is characterized by: In S3, the specific steps of designing the thinking chain prompt sample are as follows: S31: First, we will artificially construct examples of thought chain problems in the field of network security; S32: Then, chatGPT is used to generate a thought chain answer sample, and the manual question and chatGPT answer are combined into a complete thought chain prompt sample. This process is repeated to construct a certain amount of thought chain prompt samples; S33: Then conduct a preliminary experiment on the sample thinking chain prompts to screen out a small number of effective sample thinking chain prompts for subsequent use.

6. The network security knowledge reasoning method based on thought chain according to claim 1 is characterized by: In S3, the thought chain prompt examples need to meet the following requirements: The questions need to cover the fields of cyberspace security including computer networks, cryptography, databases, blockchain, and network attack and defense; The answer needs to include a two- or three-step reasoning process rather than simply outputting the answer.

7. The network security knowledge reasoning method based on thought chain according to claim 1 is characterized by: In S4, the thought chain prompt examples screened out in S3 are input into the large language model as learning samples for the small-sample reasoning of the large model. Then, by adding the "Let's think step by step" method at the end of the input question, the zero-sample reasoning of the thought chain prompt method is combined with the small-sample reasoning method.

8. The network security knowledge reasoning method based on thought chain according to claim 1 is characterized by: The cybersecurity academic materials include four categories of documents in the field of cyberspace security: domestic conferences, academic journals, degree theses and Chinese patents.

Images