Network security protection system introducing artificial intelligence model

Abstract

The embodiment of the invention relates to a network security protection system introducing an artificial intelligence model. The system comprises a data acquisition module, a model scheduling module, an anomaly prediction model, a multi-task large language model, a strategy knowledge base, a strategy distribution module and a strategy implementation module, wherein the model scheduling module is used for calling an exception prediction model and a multi-task large language model to perform exception attack prediction, threat event identification, protection strategy generation and safety report generation processing according to a terminal data set actually acquired by the data acquisition module to obtain a corresponding protection strategy sequence and a safety report; the strategy distribution module is used for sending the protection strategy sequence to the strategy implementation module and sending the safety report to the notification interface; and the strategy implementation module is used for performing protection strategy response on the specified network terminal according to the protection strategy sequence. Based on the two introduced artificial intelligence models, the overall defense capability of the system can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a network security protection system introducing an artificial intelligence model. Background Art

[0002] The network security protection system refers to a processing system that can identify security threat events that may cause network security incidents based on real-time collected network time series data, customize corresponding protection strategies based on the identified threat event types, and actively implement defense based on the customized protection strategies. The network time series data mentioned here at least includes flow time series data, service time series data and log time series data; among them, flow time series data refers to the flow data sequence of the underlying / application layer network protocol packets (such as TCP protocol packets, UDP protocol packets, HTTP protocol packets, HTTPS protocol packets, etc.) obtained through network port monitoring, service time series data refers to the service application (such as registration service application, identity authentication service application, query service application, etc.) data sequence obtained through service port monitoring, and log time series data refers to the system log data sequence obtained through system log monitoring. The security threat events mentioned here include various types of network attack / vulnerability event types at various levels (such as network protocol packet level, service application level, etc.). The protection strategies mentioned here refer to network defense measures corresponding to various types of threat events or combinations of threat events (such as protection strategies for dealing with abnormal attacks / vulnerabilities at the network protocol packet level, protection strategies for dealing with abnormal attacks / vulnerabilities at the service application level, protection strategies for dealing with concurrent abnormal attacks / vulnerabilities at the network protocol packet level and service application level, etc.).

[0003] At present, conventional network security protection systems will mostly configure event identification rules and policy customization rules based on the manual experience of network security experts in advance when performing threat event identification and protection strategy customization. However, due to the limitation of manual expertise, this conventional processing method often has problems such as insufficient configuration experience, insufficient monitoring, and weak intelligence, which leads to the inability to effectively improve the overall defense capability of the system. Artificial Intelligence (AI) models, such as Deep Learning Models (Deep Learning Model) and Large Language Models (LLM), etc., have a much stronger feature learning ability for various threat events and even protection rules than ordinary people after big data training. If the AI ​​model can be applied to the network security protection system, it is bound to be able to effectively improve the overall defense capability of the system. So, how to introduce an AI model into the system to handle threat event identification and protection strategy customization tasks is the technical problem that the present invention needs to solve. Summary of the invention

[0004] The purpose of the present invention is to provide a network security protection system that introduces an artificial intelligence model in view of the defects of the prior art. The system includes: a data acquisition module, a model scheduling module, an abnormal prediction model, a multi-task large language model, a policy knowledge base, a policy distribution module and a policy implementation module; wherein the data acquisition module is used to collect the flow / service / log time series data of the specified network terminal and form a corresponding terminal data set to send to the model scheduling module; the model scheduling module is used to call the abnormal prediction model and the multi-task large language model to perform abnormal attack prediction, threat event identification, protection strategy generation and security report generation processing according to the terminal data set to obtain the corresponding protection strategy sequence and security report; the policy distribution module is used to send the protection strategy sequence to the policy implementation module and send the security report to the notification interface; the policy implementation module is used to respond to the protection strategy of the specified network terminal according to the protection strategy sequence. The present invention introduces a custom deep learning model (i.e., an abnormal prediction model) and a large language model (i.e., a multi-task large language model) in the network security protection system. The two AI models introduced based on the present invention can improve the system's feature learning and recognition capabilities for various threat events and even protection strategies, improve the system's prevention efficiency for various threat events, and effectively improve the system's overall defense capabilities.

[0005] To achieve the above-mentioned purpose, an embodiment of the present invention provides a network security protection system that introduces an artificial intelligence model, the system comprising: a data acquisition module, a model scheduling module, an abnormality prediction model, a multi-task large language model, a policy knowledge base, a policy distribution module and a policy implementation module;

[0006] The model scheduling module is connected to the data acquisition module, the abnormal prediction model, the multi-task large language model and the strategy distribution module respectively; the multi-task large language model is connected to the strategy knowledge base; the strategy distribution module is connected to the strategy implementation module;

[0007] The data acquisition module is used to monitor the network protocol layer of all designated network ports of the designated network terminal in real time to obtain and save the corresponding first flow records, and to monitor the service applications of all designated service ports of the current designated network terminal in real time to obtain and save the corresponding first service records, and to monitor the operation log of the current designated network terminal in real time to obtain and save the corresponding first log records; and to regularly form a corresponding first flow record sequence, a first service record sequence and a first log record sequence with all the first flow records, all the first service records and all the first log records corresponding to the current designated network terminal within the latest first preset time period according to a first preset time frequency, and to form a corresponding first terminal data set with the first terminal identifier corresponding to the current designated network terminal, the first flow record sequence, the first service record sequence and the first log record sequence to send to the model scheduling module;

[0008] The model scheduling module is used to extract the corresponding first terminal identifier, the first traffic record sequence, the first service record sequence and the first log record sequence from the first terminal data set; and the first traffic record sequence, the first service record sequence and the first log record sequence form a corresponding first monitoring data set; and send the first monitoring data set to the abnormal prediction model, and receive the first abnormal prediction vector sent back by the abnormal prediction model; and input the first monitoring data set and the first abnormal prediction vector into a preset threat event identification task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding threat event identification instruction text and send it to the multi-task large language model, and receive the first threat event sequence sent back by the multi-task large language model; and when the first threat event sequence is not empty, the first threat event The preset protection strategy generation task instruction template is input into the sequence, and the corresponding task instruction text is encapsulated and processed to obtain the corresponding protection strategy generation instruction text, which is sent to the multi-task large language model, and the first protection strategy sequence sent back by the multi-task large language model is received; and when the first protection strategy sequence is not empty, the first terminal identifier, the first monitoring data set, the first abnormality prediction vector and the first protection strategy sequence are input into the preset security report generation task instruction template, and the corresponding task instruction text is encapsulated and processed to obtain the corresponding security report generation instruction text, which is sent to the multi-task large language model, and the first security report sent back by the multi-task large language model is received; and when the first security report is not empty, the first scheduling data set composed of the first terminal identifier, the first protection strategy sequence and the first security report is sent to the policy distribution module;

[0009] The abnormal prediction model is used to perform abnormal attack prediction processing according to the first monitoring data set to obtain the corresponding first abnormal prediction vector and send it back to the model scheduling module; the first abnormal prediction vector is composed of multiple first abnormal prediction probabilities; each of the first abnormal prediction probabilities corresponds to a type of network attack event;

[0010] The multi-task large language model is used to perform threat event identification processing according to the threat event identification instruction text to obtain the corresponding first threat event sequence and send it back to the model scheduling module; the multi-task large language model is also used to perform protection strategy generation processing according to the protection strategy generation instruction text and the strategy knowledge base to obtain the corresponding first protection strategy sequence and send it back to the model scheduling module; the multi-task large language model is also used to perform security report generation processing according to the security report generation instruction text to obtain the corresponding first security report and send it back to the model scheduling module; when the first threat event sequence is not empty, it is composed of one or more first threat event types; when the first protection strategy sequence is not empty, it is composed of one or more first protection strategy types;

[0011] The policy knowledge base is used to store multiple first policy knowledge records; the first policy knowledge record consists of a first policy type and a first event type set; each of the first policy types is a protection policy type; the first event type set consists of one or more first event types, and each of the first event types is a threat event type;

[0012] The policy distribution module is used to send the first terminal identifier and the first protection policy sequence of the first scheduling data set to the policy implementation module; and send the first security report of the first scheduling data set to a preset notification interface;

[0013] The policy implementation module is used to perform protection policy response processing on the designated network terminal corresponding to the first terminal identifier according to the first protection policy sequence.

[0014] Preferably, the designated network terminal includes any type of network resource facilities, including at least a network module, a network device, a network equipment, a network service interface / microservice interface, a network virtual machine, a network database, a network server, a network platform, a network system and a network cloud;

[0015] The first flow record sequence is formed by sorting a plurality of the first flow records in chronological order; the first flow record includes a first monitoring time, a first monitoring port, a first monitoring protocol type and a first monitoring flow; the first monitoring port is an IP address port; the first monitoring protocol type is a network data transmission protocol of a bottom layer or application layer; the first monitoring flow is the monitoring data flow corresponding to the current monitoring protocol at the current monitoring time on the current monitoring port;

[0016] The first service record sequence is formed by sorting a plurality of the first service records in chronological order; the first service record includes a second monitoring time, a first monitoring address, a first monitoring service type and a first monitoring service parameter; the first monitoring address is a URL address of a service; the first monitoring service type is a type of service application; the first monitoring service parameter is a service application parameter corresponding to the current monitoring service type at the current monitoring address at the current monitoring time;

[0017] The first log record sequence is composed of multiple first log records arranged in chronological order; the first log record includes a third monitoring time, a first monitoring device identifier and a first monitoring log; the first monitoring device identifier is a unique device identifier of a network device; the first monitoring log is a device operation log generated on the current network device at the current monitoring time.

[0018] Preferably, the abnormality prediction model is a customized deep learning model; the model structure of the abnormality prediction model consists of a first encoding module, a second encoding module, a third encoding module, a first CNN network, a second CNN network, a third CNN network, a first pooling layer, a second pooling layer, a third pooling layer, a first fully connected layer, a second fully connected layer, a third fully connected layer, a first feature fusion module and a first MLP network;

[0019] The input end of the first encoding module is used to receive the corresponding first traffic record sequence, and the output end is connected to the input end of the first CNN network; the input end of the second encoding module is used to receive the corresponding first service record sequence, and the output end is connected to the input end of the second CNN network; the input end of the third encoding module is used to receive the corresponding first log record sequence, and the output end is connected to the input end of the third CNN network; the output ends of the first, second and third CNN networks are respectively connected to the input ends of the corresponding first, second and third pooling layers; the output ends of the first, second and third pooling layers are respectively connected to the input ends of the first, second and third fully connected layers; the output ends of the first, second and third fully connected layers are respectively connected to the first, second and third input ends of the first feature fusion module; the output end of the first feature fusion module is connected to the input end of the first MLP network; the output end of the first MLP network is used to output the corresponding first abnormality prediction vector;

[0020] The first encoding module is used to remove punctuation marks from each of the first traffic records in the first traffic record sequence to obtain a corresponding first punctuation-free text; and perform word segmentation processing on each of the first punctuation-free texts to obtain a corresponding first word segmentation sequence; and perform word embedding encoding processing on each of the first word segmentation sequences to obtain a corresponding first word encoding vector; and form a corresponding first encoding tensor composed of all the obtained first word encoding vectors and send it to the first CNN network;

[0021] The second encoding module is used to remove punctuation marks from each of the first service records in the first service record sequence to obtain a corresponding second punctuation-free text; and perform word segmentation processing on each of the second punctuation-free texts to obtain a corresponding second word segmentation sequence; and perform word embedding encoding processing on each of the second word segmentation sequences to obtain a corresponding second word encoding vector; and form a corresponding second encoding tensor composed of all the obtained second word encoding vectors and send it to the second CNN network;

[0022] The third encoding module is used to remove punctuation marks from each of the first log records in the first log record sequence to obtain a corresponding third punctuation-free text; and perform word segmentation processing on each of the third punctuation-free texts to obtain a corresponding third word segmentation sequence; and perform word embedding encoding processing on each of the third word segmentation sequences to obtain a corresponding third word encoding vector; and form a corresponding third encoding tensor composed of all the obtained third word encoding vectors and send it to the third CNN network;

[0023] The first, second and third CNN networks are each composed of multiple convolutional layers; the first CNN network is used to perform feature extraction processing on the first coding tensor to obtain the corresponding first feature tensor and send it to the first pooling layer; the second CNN network is used to perform feature extraction processing on the second coding tensor to obtain the corresponding second feature tensor and send it to the second pooling layer; the third CNN network is used to perform feature extraction processing on the third coding tensor to obtain the corresponding third feature tensor and send it to the third pooling layer;

[0024] The first pooling layer is used to perform feature dimensionality reduction processing on the first feature tensor according to the preset pooling strategy to obtain the corresponding first dimensionality reduction feature and send it to the first fully connected layer; the second pooling layer is used to perform feature dimensionality reduction processing on the second feature tensor according to the preset pooling strategy to obtain the corresponding second dimensionality reduction feature and send it to the second fully connected layer; the third pooling layer is used to perform feature dimensionality reduction processing on the third feature tensor according to the preset pooling strategy to obtain the corresponding third dimensionality reduction feature and send it to the third fully connected layer; the preset pooling strategy includes a maximum pooling method and an average pooling method;

[0025] The first fully connected layer is used to perform one-dimensional vector conversion on the first dimension reduction feature to obtain a corresponding first feature vector and send it to the first feature fusion module; the second fully connected layer is used to perform one-dimensional vector conversion on the second dimension reduction feature to obtain a corresponding second feature vector and send it to the first feature fusion module; the third fully connected layer is used to perform one-dimensional vector conversion on the third dimension reduction feature to obtain a corresponding third feature vector and send it to the first feature fusion module; the output vector lengths of the first, second and third fully connected layers are kept consistent;

[0026] The first feature fusion module is used to perform weighted sum processing on the first, second and third feature vectors and send the obtained result vector as the corresponding first fusion vector to the first MLP network;

[0027] The first MLP network is composed of multiple fully connected layers; the first MLP network is used to predict the occurrence probabilities of multiple types of network attack events according to the first fusion vector to obtain the corresponding first anomaly prediction vector.

[0028] Furthermore, the abnormality prediction model is trained based on a preset first model data set in a supervised model training manner before the model is applied; and the abnormality prediction model is fine-tuned based on the latest second model data set in a supervised model training manner regularly after the model is applied;

[0029] The first model data set is composed of a plurality of first data records; the first data record is composed of a first training traffic record sequence, a first training service record sequence, a first training log record sequence, and a first abnormal label vector; the first abnormal label vector is composed of a plurality of first abnormal label probabilities; each of the first abnormal label probabilities corresponds to a type of network attack event; the value of each of the first abnormal label probabilities is set to 0 or 1;

[0030] The second model data set consists of a plurality of second data records; the second data record consists of a second training traffic record sequence, a second training service record sequence, a second training log record sequence, and a second abnormal label vector; the second abnormal label vector consists of a plurality of second abnormal label probabilities; each of the second abnormal label probabilities corresponds to a type of network attack event; the value of each of the second abnormal label probabilities is set to 0 or 1;

[0031] The data timeliness of the second model dataset is better than that of the first model dataset; and the total number of records of the second model dataset is less than that of the first model dataset.

[0032] Preferably, the multi-task large language model is implemented based on a large language model that has completed model pre-training through a public natural language corpus; the large language model includes at least a GPT series model and a BERT series model;

[0033] The natural language instruction template of the multi-task large language model includes at least three types of task instruction templates, namely, the threat event identification task instruction template, the protection strategy generation task instruction template and the security report generation task instruction template;

[0034] The threat event identification task instruction template is a formatted natural language instruction template of the multi-task large language model; the threat event identification task instruction template is used to use the first traffic record sequence, the first service record sequence and the first log record sequence of the first monitoring data set input by the template as the corresponding current traffic time series data set, the current service time series data set and the current log time series data set; and each of the first abnormal prediction probabilities of the first abnormal prediction vector input by the template and the corresponding network attack event constitute a corresponding network attack prediction data, and all the obtained network attack prediction data constitute a corresponding current network attack prediction data set; and based on a preset narrative natural language text, the multi-task large language model is required to perform threat event identification processing according to the current traffic time series data set, the current service time series data set, the current log time series data set and the current network attack prediction data set, and the multi-task large language model is required to assemble the output sequence of all identified threat event types according to a preset text output sequence structure to obtain the corresponding first threat event sequence and output it;

[0035] The protection strategy generation task instruction template is a formatted natural language instruction template of the multi-task large language model; the protection strategy generation task instruction template is used to take the first threat event sequence input by the template as the corresponding current threat event sequence; and based on a preset narrative natural language text, the multi-task large language model is required to search the policy knowledge base for the protection strategy type that best matches each of the first threat events in the current threat event sequence, and remove duplicates and combine all the obtained protection strategy types to obtain the corresponding optimal protection strategy type combination, and the multi-task large language model is required to assemble the identified optimal protection strategy type combination into an output sequence according to a preset text output sequence structure to obtain the corresponding first protection strategy sequence and output it;

[0036] The security report generation task instruction template is a formatted natural language instruction template of the multi-task large language model; the security report generation task instruction template is used to use the first terminal identifier, the first monitoring data set, the first abnormal prediction vector and the first protection strategy sequence input by the template as the corresponding current terminal identifier, the current monitoring data set, the current abnormal prediction vector and the current protection strategy sequence; and each of the first abnormal prediction probabilities of the current abnormal prediction vector and its corresponding network attack event constitutes a corresponding network attack prediction data set, and all the obtained network attack prediction data constitute a corresponding current network attack prediction data set; and use a preset security report text structure template as the corresponding current text structure template; and based on a preset narrative natural language text, require the multi-task large language model to bring the current terminal identifier, the current monitoring data set, the current network attack prediction data set and the current protection strategy sequence into the current text structure template for report text assembly and generation processing, and output the final generated text as the corresponding first security report.

[0037] Further, before the model is applied, the threat event identification task processing parameters of the multi-task large language model are fine-tuned based on the preset third model data set in a supervised model training manner; before the model is applied, the protection strategy generation task processing parameters of the multi-task large language model are fine-tuned based on the preset fourth model data set and the policy knowledge base in a supervised model training manner; before the model is applied, the security report generation task processing parameters of the multi-task large language model are fine-tuned based on the preset fifth model data set in a supervised model training manner; after the model is applied, the threat event identification task processing parameters of the multi-task large language model are fine-tuned regularly based on the latest sixth model data set in a supervised model training manner;

[0038] Wherein, the third model data set is composed of multiple third data records; the third data record is composed of a third training traffic record sequence, a third training service record sequence, a third training log record sequence, a fifth training anomaly prediction vector and a first threat event label sequence; the first threat event label sequence is composed of multiple first threat event type labels;

[0039] The fourth model data set is composed of a plurality of fourth data records; the fourth data record is composed of a first training threat event sequence and a first protection strategy label sequence; the first protection strategy label sequence is composed of a plurality of first protection strategy type labels;

[0040] The fifth model data set is composed of a plurality of fifth data records; the fifth data record is composed of a first training terminal identifier, a first training monitoring data set, a sixth training anomaly prediction vector, a first training protection strategy sequence and a first label safety report;

[0041] The sixth model data set consists of a plurality of sixth data records; the sixth data record consists of a fourth training traffic record sequence, a fourth training service record sequence, a fourth training log record sequence, a seventh training anomaly prediction vector, and a second threat event label sequence; the second threat event label sequence consists of a plurality of second threat event type labels;

[0042] The data timeliness of the sixth model data set is better than that of the third model data set; the total number of records of the sixth model data set is less than that of the third model data set.

[0043] The embodiment of the present invention provides a network security protection system that introduces an artificial intelligence model, the system includes: a data acquisition module, a model scheduling module, an abnormal prediction model, a multi-task large language model, a policy knowledge base, a policy distribution module and a policy implementation module; wherein the data acquisition module is used to collect the flow / service / log time series data of the specified network terminal and form a corresponding terminal data set to send to the model scheduling module; the model scheduling module is used to call the abnormal prediction model and the multi-task large language model to perform abnormal attack prediction, threat event identification, protection strategy generation and security report generation processing according to the terminal data set to obtain the corresponding protection strategy sequence and security report; the policy distribution module is used to send the protection strategy sequence to the policy implementation module and send the security report to the notification interface; the policy implementation module is used to respond to the protection strategy of the specified network terminal according to the protection strategy sequence. The embodiment of the present invention introduces a custom deep learning model (i.e., an abnormal prediction model) and a large language model (i.e., a multi-task large language model) in the network security protection system. The two AI models introduced based on the embodiment of the present invention not only improve the system's feature learning and recognition capabilities for various threat events and even protection strategies, but also improve the system's prevention efficiency for various threat events, and also improve the system's overall defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A module structure diagram of a network security protection system that introduces an artificial intelligence model provided by an embodiment of the present invention;

[0045] Figure 2 A module structure diagram of an abnormality prediction model provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of three types of task input / output data of a multi-task large language model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The embodiment of the present invention provides a network security protection system that introduces an artificial intelligence model, such as Figure 1 As shown in the module structure diagram of a network security protection system that introduces an artificial intelligence model provided by an embodiment of the present invention, the system mainly includes: a data acquisition module 1, a model scheduling module 2, an anomaly prediction model 3, a multi-task large language model 4, a strategy knowledge base 5, a strategy distribution module 6 and a strategy implementation module 7.

[0049] The connection relationship between the various system components of the embodiment of the present invention is: the model scheduling module 2 is connected to the data acquisition module 1, the anomaly prediction model 3, the multi-task large language model 4 and the strategy distribution module 6 respectively; the multi-task large language model 4 is connected to the strategy knowledge base 5; the strategy distribution module 6 is connected to the strategy implementation module 7.

[0050] (I) Data acquisition module 1:

[0051] The data acquisition module 1 of the embodiment of the present invention is used to monitor the network protocol layer of all designated network ports of the designated network terminal in real time to obtain and save the corresponding first flow record, and to monitor the service application of all designated service ports of the current designated network terminal in real time to obtain and save the corresponding first service record, and to monitor the operation log of the current designated network terminal in real time to obtain and save the corresponding first log record; and to regularly organize all the first flow records, all the first service records and all the first log records corresponding to the current designated network terminal within the last first preset time period into a corresponding first flow record sequence, first service record sequence and first log record sequence according to a first preset time frequency, and to form a corresponding first terminal data set composed of the first terminal identifier, first flow record sequence, first service record sequence and first log record sequence corresponding to the current designated network terminal and send it to the model scheduling module 2.

[0052] Here, the designated network terminal includes any type of network resource facilities, including at least network modules, network devices, network equipment, network service interfaces / microservice interfaces, network virtual machines, network databases, network servers, network platforms, network systems and network clouds.

[0053] The first preset time frequency is a preset time frequency parameter; the first preset duration is a preset time length parameter.

[0054] The first flow record sequence is composed of multiple first flow records sorted in chronological order; wherein, the first flow record includes a first monitoring time, a first monitoring port, a first monitoring protocol type and a first monitoring flow; the first monitoring port is an IP address port; the first monitoring protocol type is a type of underlying or application layer network data transmission protocol, such as TCP protocol, UDP protocol, HTTP protocol, HTTPS protocol, etc.; the first monitoring flow is the monitoring data flow corresponding to the current monitoring protocol at the current monitoring time on the current monitoring port.

[0055] The first service record sequence is composed of multiple first service records sorted in chronological order; wherein, the first service record includes a second monitoring time, a first monitoring address, a first monitoring service type and a first monitoring service parameter; the first monitoring address is a URL address of a service; the first monitoring service type is a type of service application, such as a registration service application, an identity authentication service application, a query service application, etc.; the first monitoring service parameter is a service application parameter corresponding to the current monitoring service type at the current monitoring address at the current monitoring time.

[0056] The first log record sequence is composed of multiple first log records sorted in chronological order; wherein, the first log record includes a third monitoring time, a first monitoring device identifier and a first monitoring log; the first monitoring device identifier is a unique device identifier of a network device; the first monitoring log is a device operation log generated on the current network device at the current monitoring time.

[0057] (II) Model scheduling module 2:

[0058] The model scheduling module 2 of the embodiment of the present invention is used to extract the corresponding first terminal identifier, the first traffic record sequence, the first service record sequence and the first log record sequence from the first terminal data set; and the first traffic record sequence, the first service record sequence and the first log record sequence form a corresponding first monitoring data set; and send the first monitoring data set to the abnormal prediction model 3, and receive the first abnormal prediction vector sent back by the abnormal prediction model 3; and input the first monitoring data set and the first abnormal prediction vector into a preset threat event identification task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding threat event identification instruction text and send it to the multi-task large language model 4, and receive the first threat event sequence sent back by the multi-task large language model 4; and when the first threat event sequence is not empty, the first threat event The preset protection strategy generation task instruction template is input into the sequence, and the corresponding task instruction text is encapsulated and processed to obtain the corresponding protection strategy generation instruction text, which is sent to the multi-task large language model 4, and the first protection strategy sequence sent back by the multi-task large language model 4 is received; and when the first protection strategy sequence is not empty, the first terminal identifier, the first monitoring data set, the first abnormal prediction vector and the first protection strategy sequence are input into the preset security report generation task instruction template, and the corresponding task instruction text is encapsulated and processed to obtain the corresponding security report generation instruction text, which is sent to the multi-task large language model 4, and the first security report sent back by the multi-task large language model 4 is received; and when the first security report is not empty, the first scheduling data set composed of the first terminal identifier, the first protection strategy sequence and the first security report is sent to the policy distribution module 6.

[0059] (III) Abnormal prediction model 3:

[0060] The anomaly prediction model 3 of the embodiment of the present invention is used to perform abnormal attack prediction processing based on the first monitoring data set to obtain the corresponding first anomaly prediction vector and send it back to the model scheduling module 2; wherein the first anomaly prediction vector is composed of multiple first anomaly prediction probabilities; each first anomaly prediction probability corresponds to a type of network attack event.

[0061] The abnormal prediction model 3 of the embodiment of the present invention is a customized deep learning model. Figure 2 As shown in the module structure diagram of the abnormality prediction model provided by an embodiment of the present invention, the model structure of the abnormality prediction model 3 is composed of a first encoding module, a second encoding module, a third encoding module, a first CNN network, a second CNN network, a third CNN network, a first pooling layer, a second pooling layer, a third pooling layer, a first fully connected layer, a second fully connected layer, a third fully connected layer, a first feature fusion module and a first MLP network.

[0062] The connection relationship between the modules of the abnormal prediction model 3 is as follows: the input end of the first encoding module is used to receive the corresponding first traffic record sequence, and the output end is connected to the input end of the first CNN network; the input end of the second encoding module is used to receive the corresponding first service record sequence, and the output end is connected to the input end of the second CNN network; the input end of the third encoding module is used to receive the corresponding first log record sequence, and the output end is connected to the input end of the third CNN network; the output ends of the first, second and third CNN networks are respectively connected to the input ends of the corresponding first, second and third pooling layers; the output ends of the first, second and third pooling layers are respectively connected to the input ends of the first, second and third fully connected layers; the output ends of the first, second and third fully connected layers are respectively connected to the first, second and third input ends of the first feature fusion module; the output end of the first feature fusion module is connected to the input end of the first MLP network; the output end of the first MLP network is used to output the corresponding first abnormal prediction vector.

[0063] The module functions of each module of the abnormal prediction model 3 are as follows:

[0064] 1) The first encoding module is used to remove punctuation marks from each first traffic record of the first traffic record sequence to obtain a corresponding first punctuation-free text; and perform word segmentation processing on each first punctuation-free text to obtain a corresponding first word segmentation sequence; and perform word embedding encoding processing on each first word segmentation sequence to obtain a corresponding first word encoding vector; and all the obtained first word encoding vectors form a corresponding first encoding tensor and send it to the first CNN network;

[0065] 2) The second encoding module is used to remove punctuation marks from each first service record of the first service record sequence to obtain a corresponding second punctuation-free text; and perform word segmentation processing on each second punctuation-free text to obtain a corresponding second word segmentation sequence; and perform word embedding encoding processing on each second word segmentation sequence to obtain a corresponding second word encoding vector; and all the obtained second word encoding vectors form a corresponding second encoding tensor and send it to the second CNN network;

[0066] 3) The third encoding module is used to remove punctuation marks from each first log record of the first log record sequence to obtain a corresponding third punctuation-free text; and perform word segmentation processing on each third punctuation-free text to obtain a corresponding third word segmentation sequence; and perform word embedding encoding processing on each third word segmentation sequence to obtain a corresponding third word encoding vector; and form a corresponding third encoding tensor from all the obtained third word encoding vectors and send it to the third CNN network;

[0067] 4) The first, second and third CNN networks are each composed of multiple convolutional layers; the first CNN network is used to perform feature extraction processing on the first coding tensor to obtain the corresponding first feature tensor and send it to the first pooling layer; the second CNN network is used to perform feature extraction processing on the second coding tensor to obtain the corresponding second feature tensor and send it to the second pooling layer; the third CNN network is used to perform feature extraction processing on the third coding tensor to obtain the corresponding third feature tensor and send it to the third pooling layer;

[0068] 5) The first pooling layer is used to perform feature dimensionality reduction processing on the first feature tensor according to the preset pooling strategy to obtain the corresponding first dimensionality reduction feature and send it to the first fully connected layer; the second pooling layer is used to perform feature dimensionality reduction processing on the second feature tensor according to the preset pooling strategy to obtain the corresponding second dimensionality reduction feature and send it to the second fully connected layer; the third pooling layer is used to perform feature dimensionality reduction processing on the third feature tensor according to the preset pooling strategy to obtain the corresponding third dimensionality reduction feature and send it to the third fully connected layer; the preset pooling strategy includes the maximum pooling method and the average pooling method;

[0069] 6) The first fully connected layer is used to perform one-dimensional vector conversion on the first dimension reduction feature to obtain the corresponding first feature vector and send it to the first feature fusion module; the second fully connected layer is used to perform one-dimensional vector conversion on the second dimension reduction feature to obtain the corresponding second feature vector and send it to the first feature fusion module; the third fully connected layer is used to perform one-dimensional vector conversion on the third dimension reduction feature to obtain the corresponding third feature vector and send it to the first feature fusion module; the output vector lengths of the first, second and third fully connected layers are kept consistent;

[0070] 7) The first feature fusion module is used to perform weighted sum processing on the first, second and third feature vectors and send the obtained result vector as the corresponding first fusion vector to the first MLP network;

[0071] 8) The first MLP network is composed of multiple fully connected layers; the first MLP network is used to predict the occurrence probability of multiple types of network attack events according to the first fusion vector to obtain the corresponding first anomaly prediction vector.

[0072] It should be noted that before the model is applied, the anomaly prediction model 3 needs to be trained based on the preset first model data set in a supervised model training method; after the model is applied, the anomaly prediction model 3 needs to be fine-tuned regularly based on the latest second model data set in a supervised model training method.

[0073] The first and second model data sets mentioned here are label data sets constructed in advance through data collection: 1) The first model data set consists of multiple first data records; the first data record consists of a first training traffic record sequence, a first training service record sequence, a first training log record sequence, and a first abnormal label vector; the first abnormal label vector consists of multiple first abnormal label probabilities; each first abnormal label probability corresponds to a type of network attack event; the value of each first abnormal label probability is set to 0 or 1. 2) The second model data set consists of multiple second data records; the second data record consists of a second training traffic record sequence, a second training service record sequence, a second training log record sequence, and a second abnormal label vector; the second abnormal label vector consists of multiple second abnormal label probabilities; each second abnormal label probability corresponds to a type of network attack event; the value of each second abnormal label probability is set to 0 or 1. It should be noted that the second model data set is a data set constructed by regularly collecting the latest data, so the data timeliness of the second model data set is better than that of the first model data set; but in general, the amount of the latest collected data is not large, so the total number of records in the second model data set is smaller than that of the first model data set.

[0074] In a specific implementation of the embodiment of the present invention, the above-mentioned processing steps of training the abnormality prediction model 3 based on the preset first model data set in a supervised model training manner before the model is applied specifically include:

[0075] Step A1, dividing the first model data set into two data subsets according to a preset first division ratio and recording them as a corresponding first training set and a first evaluation set;

[0076] The first segmentation ratio is a preset ratio parameter, such as 8:2; the first training set and the first evaluation set are both composed of a plurality of first data records; the ratio of the total number of records in the first training set to the total number of records in the first evaluation set satisfies the first segmentation ratio;

[0077] Step A2, taking the first first data record of the first training set as the corresponding current training record;

[0078] Step A3, inputting the first training traffic record sequence, the first training service record sequence and the first training log record sequence of the current training record into the anomaly prediction model 3 for processing to obtain the corresponding first training anomaly prediction vector;

[0079] Step A4, bringing the first training anomaly prediction vector and the first anomaly label vector of the current training record into a preset first model loss function; and based on the preset first model optimizer, performing a round of modulation on the model parameters of the anomaly prediction model 3 in a direction that minimizes the first model loss function;

[0080] Wherein, the first model loss function includes at least an L1 loss function, an L2 loss function and a cross entropy loss function; the first model optimizer includes at least an SGD optimizer and an ADAM optimizer;

[0081] Step A5, identifying whether the current training record is the last first data record of the first training set; if so, going to step A6; if not, extracting the next first data record of the first training set as the new current training record and returning to step A3;

[0082] Step A6, perform a round of traversal on all the first data records of the first evaluation set; and in this round of traversal, use the currently traversed first data record as the corresponding current evaluation record; and input the first training traffic record sequence, the first training service record sequence and the first training log record sequence of the current evaluation record into the abnormal prediction model 3 for processing to obtain the corresponding second training abnormal prediction vector; and form a corresponding first prediction-label pair by the second training abnormal prediction vector and the first abnormal label vector of the current evaluation record; and at the end of this round of traversal, calculate the corresponding accuracy, precision, recall and F1 score based on all the first prediction-label pairs obtained to obtain the corresponding first accuracy, first precision, first recall and first F1 score;

[0083] Step A7, identifying the first accuracy, the first precision, the first recall and the first F1 score; if the first accuracy does not meet the preset first accuracy range, or the first accuracy does not meet the preset first accuracy range, or the first recall does not meet the preset first recall range, or the first F1 score does not meet the preset first F1 score range, then return to step A2 to continue training; if the first accuracy meets the first accuracy range and the first accuracy meets the first accuracy range and the first recall meets the first recall range and the first F1 score meets the first F1 score range, then stop the current model training and confirm that the current training of the abnormality prediction model 3 is completed;

[0084] Here, the first accuracy range, the first precision range, the first recall range and the first F1 score range are four preset value ranges.

[0085] In another specific implementation of the embodiment of the present invention, the above-mentioned processing steps of regularly fine-tuning the abnormality prediction model 3 based on the latest second model data set in a supervised model training manner after the model is applied specifically include:

[0086] Step B1, dividing the second model data set into two data subsets according to a preset second division ratio and recording them as a corresponding second training set and a second evaluation set;

[0087] The second segmentation ratio is a preset ratio parameter, such as 8:2; the second training set and the second evaluation set are both composed of a plurality of second data records; the ratio of the total number of records in the second training set to the total number of records in the second evaluation set satisfies the second segmentation ratio;

[0088] Step B2, taking the first second data record of the second training set as the corresponding current training record;

[0089] Step B3, inputting the second training traffic record sequence, the second training service record sequence and the second training log record sequence of the current training record into the anomaly prediction model 3 for processing to obtain a corresponding third training anomaly prediction vector;

[0090] Step B4, bringing the third training anomaly prediction vector and the second anomaly label vector of the current training record into the preset second model loss function; and based on the preset second model optimizer, performing a round of modulation on the model parameters of the first MLP network of the anomaly prediction model 3 in the direction of minimizing the second model loss function;

[0091] The second model loss function includes at least an L1 loss function, an L2 loss function and a cross entropy loss function; the second model optimizer includes at least an SGD optimizer and an ADAM optimizer;

[0092] Step B5, identifying whether the current training record is the last second data record of the second training set; if so, going to step B6; if not, extracting the next second data record of the second training set as the new current training record and returning to step B3;

[0093] Step B6, perform a round of traversal on all the second data records of the second evaluation set; and in this round of traversal, use the second data record currently traversed as the corresponding current evaluation record; and input the second training traffic record sequence, the second training service record sequence and the second training log record sequence of the current evaluation record into the abnormal prediction model 3 for processing to obtain the corresponding fourth training abnormal prediction vector; and form a corresponding second prediction-label pair by the fourth training abnormal prediction vector and the second abnormal label vector of the current evaluation record; and at the end of this round of traversal, perform corresponding accuracy, precision, recall and F1 score calculations on all the obtained second prediction-label pairs to obtain the corresponding second accuracy, second precision, second recall and second F1 score;

[0094] Step B7, identifying the second accuracy, the second precision, the second recall rate and the second F1 score; if the second accuracy does not meet the preset second accuracy range, or the second accuracy does not meet the preset second accuracy range, or the second recall rate does not meet the preset second recall rate range, or the second F1 score does not meet the preset second F1 score range, then return to step B2 to continue training; if the second accuracy meets the second accuracy range and the second accuracy meets the second accuracy range and the second recall rate meets the second recall rate range and the second F1 score meets the second F1 score range, then stop the current model training and confirm that the current fine-tuning of the abnormal prediction model 3 is completed;

[0095] Here, the second accuracy range, the second precision range, the second recall range and the second F1 score range are four preset value ranges.

[0096] (IV) Multi-task large language model 4:

[0097] The multi-task large language model 4 of the embodiment of the present invention is used to perform threat event identification processing according to the threat event identification instruction text to obtain the corresponding first threat event sequence and send it back to the model scheduling module 2; wherein, when the first threat event sequence is not empty, it is composed of one or more first threat event types.

[0098] The multi-task large language model 4 is also used to generate instruction texts based on the protection strategy and perform protection strategy generation processing based on the strategy knowledge base 5 to obtain the corresponding first protection strategy sequence and send it back to the model scheduling module 2; wherein, when the first protection strategy sequence is not empty, it is composed of one or more first protection strategy types.

[0099] The multi-task large language model 4 is also used to perform security report generation processing according to the security report generation instruction text to obtain the corresponding first security report and send it back to the model scheduling module 2.

[0100] Here, the multi-task large language model 4 of the embodiment of the present invention is implemented based on a type of large language model that has completed model pre-training through a public natural language corpus; the large language model includes at least a GPT series model and a BERT series model. The natural language instruction templates of the multi-task large language model 4 of the embodiment of the present invention include at least three types of task instruction templates, namely threat event identification task instruction templates, protection strategy generation task instruction templates, and security report generation task instruction templates. When the multi-task large language model 4 of the embodiment of the present invention processes the three types of tasks of threat event identification, protection strategy generation, and security report generation, the input data of the model are the three types of task instruction texts (i.e., threat event identification instruction text, protection strategy generation instruction text, and security report generation instruction text) assembled from the corresponding three types of task instruction templates, and the output data are the corresponding three types of task processing results (i.e., the first threat event sequence, the first protection strategy sequence, and the first security report), such as Figure 3 A schematic diagram of three types of task input / output data of a multi-task large language model provided in an embodiment of the present invention is shown.

[0101] It should be noted that the threat event identification task instruction template is a formatted natural language instruction template of the multi-task large language model 4. The threat event identification task instruction template is used to use the first traffic record sequence, the first service record sequence and the first log record sequence of the first monitoring data set input by the template as the corresponding current traffic time series data set, the current service time series data set and the current log time series data set; and each first abnormal prediction probability of the first abnormal prediction vector input by the template and its corresponding network attack event form a corresponding network attack prediction data, and all the obtained network attack prediction data form a corresponding current network attack prediction data set; and based on a preset narrative natural language text, the multi-task large language model 4 is required to perform threat event identification processing according to the current traffic time series data set, the current service time series data set, the current log time series data set and the current network attack prediction data set, and the multi-task large language model 4 is required to assemble the output sequence of all identified threat event types according to a preset text output sequence structure to obtain the corresponding first threat event sequence and output it.

[0102] It should be noted that the protection strategy generation task instruction template is a formatted natural language instruction template of the multi-task large language model 4. The protection strategy generation task instruction template is used to take the first threat event sequence input by the template as the corresponding current threat event sequence; and based on a preset narrative natural language text, the multi-task large language model 4 is required to search the policy knowledge base 5 for the protection strategy type that best matches each first threat event in the current threat event sequence, and to remove duplicates and combine all the obtained protection strategy types to obtain the corresponding best protection strategy type combination, and the multi-task large language model 4 is required to assemble the identified best protection strategy type combination into an output sequence according to a preset text output sequence structure to obtain the corresponding first protection strategy sequence and output it.

[0103] It should be noted that the security report generation task instruction template is a formatted natural language instruction template of the multi-task large language model 4. The security report generation task instruction template is used to use the first terminal identification, the first monitoring data set, the first abnormal prediction vector and the first protection strategy sequence of the template input as the corresponding current terminal identification, the current monitoring data set, the current abnormal prediction vector and the current protection strategy sequence; and each first abnormal prediction probability of the current abnormal prediction vector and its corresponding network attack event constitute a corresponding network attack prediction data, and all the obtained network attack prediction data constitute a corresponding current network attack prediction data set; and use a preset security report text structure template as the corresponding current text structure template; and based on a preset narrative natural language text, require the multi-task large language model 4 to bring the current terminal identification, the current monitoring data set, the current network attack prediction data set and the current protection strategy sequence into the current text structure template for report text assembly and generation processing, and output the resulting generated text as the corresponding first security report.

[0104] It should also be noted that before the model is applied, the threat event identification task processing parameters of the multi-task large language model 4 need to be fine-tuned based on the preset third model data set in a supervised model training manner; before the model is applied, the protection strategy generation task processing parameters of the multi-task large language model 4 need to be fine-tuned based on the preset fourth model data set and the policy knowledge base 5 in a supervised model training manner; before the model is applied, the security report generation task processing parameters of the multi-task large language model 4 need to be fine-tuned based on the preset fifth model data set in a supervised model training manner; after the model is applied, the threat event identification task processing parameters of the multi-task large language model 4 need to be regularly fine-tuned based on the latest sixth model data set in a supervised model training manner.

[0105] The third, fourth, fifth, and sixth model data sets mentioned here are label data sets constructed by data collection before training: 1) The third model data set consists of multiple third data records; each third data record consists of a third training traffic record sequence, a third training service record sequence, a third training log record sequence, a fifth training anomaly prediction vector, and a first threat event label sequence; each first threat event label sequence consists of multiple first threat event type labels. 2) The fourth model data set consists of multiple fourth data records; each fourth data record consists of a first training threat event sequence and a first protection strategy label sequence; each first protection strategy label sequence consists of multiple first protection strategy type labels. 3) The fifth model data set consists of multiple fifth data records; each fifth data record consists of a first training terminal identifier, a first training monitoring data set, a sixth training anomaly prediction vector, a first training protection strategy sequence, and a first label security report. 4) The sixth model data set consists of multiple sixth data records; each sixth data record consists of a fourth training traffic record sequence, a fourth training service record sequence, a fourth training log record sequence, a seventh training anomaly prediction vector, and a second threat event label sequence; each second threat event label sequence consists of multiple second threat event type labels. It should also be noted that the sixth model dataset is a dataset constructed by regularly collecting the latest data, so the data timeliness of the sixth model dataset is better than that of the third model dataset; but in general, the amount of the latest collected data is not large, so the total number of records in the sixth model dataset is smaller than that of the third model dataset.

[0106] In another specific implementation of the embodiment of the present invention, the above-mentioned processing steps of fine-tuning the threat event identification task processing parameters of the multi-task large language model 4 based on a preset third model data set in a supervised model training manner before the model is applied specifically include:

[0107] Step C1, taking a parameter subset related to the threat event identification task processing in the model parameters of the multi-task large language model 4 as the corresponding fine-tuning parameter set for this time; and dividing the third model data set into two data subsets according to a preset third division ratio and recording them as the corresponding third training set and third evaluation set;

[0108] The third segmentation ratio is a preset ratio parameter, such as 8:2; the third training set and the third evaluation set are both composed of a plurality of third data records; the ratio of the total number of records in the third training set to the total number of records in the third evaluation set satisfies the third segmentation ratio;

[0109] Step C2, taking the first third data record of the third training set as the corresponding current training record;

[0110] Step C3, the third training traffic record sequence, the third training service record sequence and the third training log record sequence of the current training record are combined into a corresponding current training monitoring data set; and the current training monitoring data set and the fifth training anomaly prediction vector of the current training record are input into the threat event identification task instruction template to perform corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text;

[0111] Step C4, inputting the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current threat event sequence;

[0112] Step C5, bringing the current threat event sequence and the first threat event label sequence of the current training record into the preset third model loss function; and based on the preset third model optimizer, performing a round of fine-tuning on the current fine-tuning parameter set in the direction of minimizing the third model loss function;

[0113] Wherein, the third model loss function at least includes a cross entropy loss function; the third model optimizer at least includes an ADAM optimizer;

[0114] Step C6, identifying whether the current training record is the last third data record of the third training set; if so, going to step C7; if not, extracting the next third data record of the third training set as the new current training record and returning to step C3;

[0115] Step C7, perform a round of traversal on all third data records of the third evaluation set; and in this round of traversal, use the third data record currently traversed as the corresponding current evaluation record; and form the corresponding current training monitoring data set with the third training traffic record sequence, the third training service record sequence and the third training log record sequence of the current evaluation record; and input the current training monitoring data set and the fifth training anomaly prediction vector of the current training record into the threat event identification task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text; and input the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current threat event sequence; and form a corresponding third prediction-label pair with the current threat event sequence and the first threat event label sequence of the current evaluation record; and at the end of this round of traversal, perform corresponding accuracy, precision, recall and F1 score calculations based on all the obtained third prediction-label pairs to obtain the corresponding third accuracy, third precision, third recall and third F1 score;

[0116] Step C8, identifying the third accuracy, the third precision, the third recall and the third F1 score; if the third accuracy does not meet the preset third accuracy range, or the third accuracy does not meet the preset third accuracy range, or the third recall does not meet the preset third recall range, or the third F1 score does not meet the preset third F1 score range, then returning to step C2 to continue training; if the third accuracy meets the third accuracy range and the third accuracy meets the third accuracy range and the third recall meets the third recall range and the third F1 score meets the third F1 score range, then stopping the current model fine-tuning and confirming that the current parameter fine-tuning of the multi-task large language model 4 is completed;

[0117] Here, the third accuracy range, the third precision range, the third recall range and the third F1 score range are four preset value ranges.

[0118] In another specific implementation of the embodiment of the present invention, the above-mentioned processing steps of fine-tuning the protection strategy generation task processing parameters of the multi-task large language model 4 based on the preset fourth model data set and the strategy knowledge base 5 in a supervised model training manner before the model is applied specifically include:

[0119] Step D1, taking a parameter subset related to the protection strategy generation task processing in the model parameters of the multi-task large language model 4 as the corresponding fine-tuning parameter set; connecting the strategy knowledge base 5 with the multi-task large language model 4; and dividing the fourth model data set into two data subsets according to a preset fourth division ratio and recording them as the corresponding fourth training set and fourth evaluation set;

[0120] The fourth segmentation ratio is a preset ratio parameter, such as 8:2; the fourth training set and the fourth evaluation set are both composed of a plurality of fourth data records; the ratio of the total number of records in the fourth training set to the total number of records in the fourth evaluation set satisfies the fourth segmentation ratio;

[0121] Step D2, taking the first fourth data record of the fourth training set as the corresponding current training record;

[0122] Step D3, inputting the first training threat event sequence of the current training record into the protection strategy generation task instruction template to perform corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text;

[0123] Step D4, inputting the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current protection strategy sequence;

[0124] Step D5, bringing the current protection strategy sequence and the first protection strategy label sequence of the current training record into the preset fourth model loss function; and based on the preset fourth model optimizer, performing a round of fine-tuning on the current fine-tuning parameter set in the direction of minimizing the fourth model loss function;

[0125] Wherein, the fourth model loss function at least includes a cross entropy loss function; the fourth model optimizer at least includes an ADAM optimizer;

[0126] Step D6, identifying whether the current training record is the last fourth data record of the fourth training set; if so, going to step D7; if not, extracting the next fourth data record of the fourth training set as the new current training record and returning to step D3;

[0127] Step D7, perform a round of traversal on all fourth data records of the fourth evaluation set; and in this round of traversal, use the fourth data record currently traversed as the corresponding current evaluation record; and input the first training threat event sequence of the current evaluation record into the protection strategy generation task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text; and input the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current protection strategy sequence; and form a corresponding fourth prediction-label pair from the current protection strategy sequence and the first protection strategy label sequence of the current evaluation record; and at the end of this round of traversal, perform corresponding accuracy, precision, recall and F1 score calculations based on all the fourth prediction-label pairs obtained to obtain the corresponding fourth accuracy, fourth precision, fourth recall and fourth F1 score;

[0128] Step D8, identifying the fourth accuracy, the fourth precision, the fourth recall and the fourth F1 score; if the fourth accuracy does not meet the preset fourth accuracy range, or the fourth accuracy does not meet the preset fourth accuracy range, or the fourth recall does not meet the preset fourth recall range, or the fourth F1 score does not meet the preset fourth F1 score range, then returning to step D2 to continue training; if the fourth accuracy meets the fourth accuracy range and the fourth accuracy meets the fourth accuracy range and the fourth recall meets the fourth recall range and the fourth F1 score meets the fourth F1 score range, then stopping the current model fine-tuning and confirming that the current parameter fine-tuning of the multi-task large language model 4 is completed;

[0129] Here, the fourth accuracy range, the fourth precision range, the fourth recall range and the fourth F1 score range are four preset value ranges.

[0130] In another specific implementation of the embodiment of the present invention, the above-mentioned processing steps of fine-tuning the security report generation task processing parameters of the multi-task large language model 4 based on the preset fifth model data set in a supervised model training manner before the model is applied specifically include:

[0131] Step E1, taking a parameter subset related to the security report generation task processing in the model parameters of the multi-task large language model 4 as the corresponding fine-tuning parameter set for this time; and dividing the fifth model data set into two data subsets according to the preset fifth division ratio and recording them as the corresponding fifth training set and fifth evaluation set;

[0132] The fifth segmentation ratio is a preset ratio parameter, such as 8:2; the fifth training set and the fifth evaluation set are both composed of a plurality of fifth data records; the ratio of the total number of records in the fifth training set to the total number of records in the fifth evaluation set satisfies the fifth segmentation ratio;

[0133] Step E2, taking the first fifth data record of the fifth training set as the corresponding current training record;

[0134] Step E3, inputting the first training terminal identifier, the first training monitoring data set, the sixth training anomaly prediction vector and the first training protection strategy sequence of the current training record into the security report generation task instruction template to perform corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text;

[0135] Step E4, inputting the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current safety report;

[0136] Step E5, bringing the current safety report and the first label safety report of the current training record into the preset fifth model loss function; and performing a round of fine-tuning on the current fine-tuning parameter set in the direction of minimizing the fifth model loss function based on the preset fifth model optimizer;

[0137] Wherein, the fifth model loss function at least includes an L2 loss function; the fifth model optimizer at least includes an ADAM optimizer;

[0138] Step E6, identifying whether the current training record is the last fifth data record of the fifth training set; if so, going to step E7; if not, extracting the next fifth data record of the fifth training set as the new current training record and returning to step E3;

[0139] Step E7, perform a round of traversal on all fifth data records of the fifth evaluation set; and in this round of traversal, use the fifth data record currently traversed as the corresponding current evaluation record; and input the first training terminal identifier, the first training monitoring data set, the sixth training anomaly prediction vector and the first training protection strategy sequence of the current evaluation record into the security report generation task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text; and input the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current safety report; and form a corresponding fifth prediction-label pair from the current safety report and the first label safety report of the current evaluation record; and at the end of this round of traversal, perform corresponding accuracy, precision, recall and F1 score calculations based on all the fifth prediction-label pairs obtained to obtain the corresponding fifth accuracy, fifth precision, fifth recall and fifth F1 score;

[0140] Step E8, identifying the fifth accuracy, the fifth precision, the fifth recall and the fifth F1 score; if the fifth accuracy does not meet the preset fifth accuracy range, or the fifth accuracy does not meet the preset fifth accuracy range, or the fifth recall does not meet the preset fifth recall range, or the fifth F1 score does not meet the preset fifth F1 score range, then return to step E2 to continue training; if the fifth accuracy meets the fifth accuracy range and the fifth accuracy meets the fifth accuracy range and the fifth recall meets the fifth recall range and the fifth F1 score meets the fifth F1 score range, then stop the current model fine-tuning and confirm that the current parameter fine-tuning of the multi-task large language model 4 is completed;

[0141] Here, the fifth accuracy range, the fifth precision range, the fifth recall range and the fifth F1 score range are four preset value ranges.

[0142] In another specific implementation of the embodiment of the present invention, the above-mentioned processing steps of regularly fine-tuning the threat event identification task processing parameters of the multi-task large language model 4 based on the latest sixth model data set in a supervised model training manner after the model is applied specifically include:

[0143] Step F1, taking a parameter subset related to the threat event identification task processing in the model parameters of the multi-task large language model 4 as the corresponding fine-tuning parameter set for this time; and dividing the sixth model data set into two data subsets according to a preset sixth division ratio and recording them as the corresponding sixth training set and sixth evaluation set;

[0144] The sixth segmentation ratio is a preset ratio parameter, such as 8:2; the sixth training set and the sixth evaluation set are both composed of a plurality of sixth data records; the ratio of the total number of records in the sixth training set to the total number of records in the sixth evaluation set satisfies the sixth segmentation ratio;

[0145] Step F2, taking the first sixth data record of the sixth training set as the corresponding current training record;

[0146] Step F3, the fourth training traffic record sequence, the fourth training service record sequence, and the fourth training log record sequence of the current training record are combined into a corresponding current training monitoring data set; and the current training monitoring data set and the seventh training anomaly prediction vector of the current training record are input into the threat event identification task instruction template to perform corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text;

[0147] Step F4, inputting the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current threat event sequence;

[0148] Step F5, bringing the current threat event sequence and the second threat event label sequence of the current training record into the preset sixth model loss function; and based on the preset sixth model optimizer, performing a round of fine-tuning on the current fine-tuning parameter set in the direction of minimizing the sixth model loss function;

[0149] Wherein, the sixth model loss function at least includes a cross entropy loss function; the sixth model optimizer at least includes an ADAM optimizer;

[0150] Step F6, identifying whether the current training record is the last sixth data record of the sixth training set; if so, going to step F7; if not, extracting the next sixth data record of the sixth training set as the new current training record and returning to step F3;

[0151] Step F7, perform a round of traversal on all sixth data records of the sixth evaluation set; and in this round of traversal, use the sixth data record currently traversed as the corresponding current evaluation record; and form the corresponding current training monitoring data set with the fourth training traffic record sequence, the fourth training service record sequence, and the fourth training log record sequence of the current evaluation record; and input the current training monitoring data set and the seventh training anomaly prediction vector of the current training record into the threat event identification task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding current instruction text; and input the current instruction text into the multi-task large language model 4 for processing to obtain the corresponding current threat event sequence; and form a corresponding sixth prediction-label pair with the current threat event sequence and the second threat event label sequence of the current evaluation record; and at the end of this round of traversal, perform corresponding accuracy, precision, recall and F1 score calculations based on all the obtained sixth prediction-label pairs to obtain the corresponding sixth accuracy, sixth precision, sixth recall and sixth F1 score;

[0152] Step F8, identifying the sixth accuracy, the sixth precision, the sixth recall and the sixth F1 score; if the sixth accuracy does not meet the preset sixth accuracy range, or the sixth precision does not meet the preset sixth precision range, or the sixth recall does not meet the preset sixth recall range, or the sixth F1 score does not meet the preset sixth F1 score range, then returning to step F2 to continue training; if the sixth accuracy meets the sixth accuracy range and the sixth precision meets the sixth precision range and the sixth recall meets the sixth recall range and the sixth F1 score meets the sixth F1 score range, then stopping the current model fine-tuning and confirming that the current parameter fine-tuning of the multi-task large language model 4 is completed;

[0153] Here, the sixth accuracy range, the sixth precision range, the sixth recall range and the sixth F1 score range are four preset value ranges.

[0154] (V) Strategy Knowledge Base 5:

[0155] The policy knowledge base 5 of the embodiment of the present invention is used to store multiple first policy knowledge records; the first policy knowledge record consists of a first policy type and a first event type set; each first policy type is a protection policy type; the first event type set consists of one or more first event types, and each first event type is a threat event type.

[0156] Here, the strategy knowledge base 5 of the embodiment of the present invention is an external knowledge base of the multi-task large language model 4. When processing the generation of protection strategies, the multi-task large language model 4 will guide the final generated protection strategy sequence through the query results of the external knowledge base.

[0157] (VI) Strategy distribution module 6:

[0158] The policy distribution module 6 of the embodiment of the present invention is used to send the first terminal identification and the first protection policy sequence of the first scheduling data set to the policy implementation module 7; and send the first security report of the first scheduling data set to a preset notification interface.

[0159] Here, the specific interface type of the preset notification interface can be customized according to the actual needs of the application, and the number of preset notification interfaces can also be customized according to the actual needs of the application; for example, the connection interfaces of the system administrator / system security officer's email, voice, SMS, instant messaging, and office system can all be regarded as one notification interface.

[0160] (VII) Strategy Implementation Module 7:

[0161] The policy implementation module 7 of the embodiment of the present invention is used to perform protection policy response processing on the designated network terminal corresponding to the first terminal identifier according to the first protection policy sequence.

[0162] Here, the policy implementation module 7 of the embodiment of the present invention is the system component used to specifically execute the protection policy in the conventional network security protection system. The module function of the policy implementation module 7 is no different from that of the conventional policy implementation module, that is, after the designated network terminal corresponding to the known operation protection object, i.e., the first terminal identifier, is identified, a series of corresponding policy implementation and security defense operations are performed according to the known protection scheme, i.e., the first protection policy sequence.

[0163] It should be noted that it should be understood that the division of the various modules of the above system is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the data acquisition module can be a separately established processing element, or it can be integrated in a chip of the above-mentioned device. In addition, it can also be stored in the memory of the above-mentioned device in the form of program code, and called and executed by a processing element of the above-mentioned system. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each method step of the aforementioned method or each module processing step of the aforementioned system can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0164] For example, the modules of the above system may be one or more integrated circuits configured to implement the aforementioned method, such as one or more application specific integrated circuits (ASIC), or one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a module of the above system is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0165] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the above method embodiments are generated. The above computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above-mentioned computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the above-mentioned computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, Bluetooth, microwave, etc.) methods. The above-mentioned computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The above-mentioned available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0166] The embodiment of the present invention provides a network security protection system that introduces an artificial intelligence model, the system includes: a data acquisition module, a model scheduling module, an abnormal prediction model, a multi-task large language model, a policy knowledge base, a policy distribution module and a policy implementation module; wherein the data acquisition module is used to collect the flow / service / log time series data of the specified network terminal and form a corresponding terminal data set to send to the model scheduling module; the model scheduling module is used to call the abnormal prediction model and the multi-task large language model to perform abnormal attack prediction, threat event identification, protection strategy generation and security report generation processing according to the terminal data set to obtain the corresponding protection strategy sequence and security report; the policy distribution module is used to send the protection strategy sequence to the policy implementation module and send the security report to the notification interface; the policy implementation module is used to respond to the protection strategy of the specified network terminal according to the protection strategy sequence. The embodiment of the present invention introduces a custom deep learning model (i.e., an abnormal prediction model) and a large language model (i.e., a multi-task large language model) in the network security protection system. The two AI models introduced based on the embodiment of the present invention not only improve the system's feature learning and recognition capabilities for various threat events and even protection strategies, but also improve the system's prevention efficiency for various threat events, and also improve the system's overall defense capabilities.

[0167] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0168] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0169] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security protection system that introduces an artificial intelligence model, characterized in that: The system includes: a data acquisition module, a model scheduling module, an abnormal prediction model, a multi-task large language model, a strategy knowledge base, a strategy distribution module and a strategy implementation module; The model scheduling module is connected to the data acquisition module, the abnormal prediction model, the multi-task large language model and the strategy distribution module respectively; the multi-task large language model is connected to the strategy knowledge base; the strategy distribution module is connected to the strategy implementation module; The data acquisition module is used to monitor the network protocol layer of all designated network ports of the designated network terminal in real time to obtain and save the corresponding first flow records, and to monitor the service applications of all designated service ports of the current designated network terminal in real time to obtain and save the corresponding first service records, and to monitor the operation log of the current designated network terminal in real time to obtain and save the corresponding first log records; and to regularly form a corresponding first flow record sequence, a first service record sequence and a first log record sequence with all the first flow records, all the first service records and all the first log records corresponding to the current designated network terminal within the latest first preset time period according to a first preset time frequency, and to form a corresponding first terminal data set with the first terminal identifier corresponding to the current designated network terminal, the first flow record sequence, the first service record sequence and the first log record sequence to send to the model scheduling module; The model scheduling module is used to extract the corresponding first terminal identifier, the first traffic record sequence, the first service record sequence and the first log record sequence from the first terminal data set; and the first traffic record sequence, the first service record sequence and the first log record sequence form a corresponding first monitoring data set; and send the first monitoring data set to the abnormal prediction model, and receive the first abnormal prediction vector sent back by the abnormal prediction model; and input the first monitoring data set and the first abnormal prediction vector into a preset threat event identification task instruction template for corresponding task instruction text encapsulation processing to obtain the corresponding threat event identification instruction text and send it to the multi-task large language model, and receive the first threat event sequence sent back by the multi-task large language model; and when the first threat event sequence is not empty, the first threat event The preset protection strategy generation task instruction template is input into the sequence, and the corresponding task instruction text is encapsulated and processed to obtain the corresponding protection strategy generation instruction text, which is sent to the multi-task large language model, and the first protection strategy sequence sent back by the multi-task large language model is received; and when the first protection strategy sequence is not empty, the first terminal identifier, the first monitoring data set, the first abnormality prediction vector and the first protection strategy sequence are input into the preset security report generation task instruction template, and the corresponding task instruction text is encapsulated and processed to obtain the corresponding security report generation instruction text, which is sent to the multi-task large language model, and the first security report sent back by the multi-task large language model is received; and when the first security report is not empty, the first scheduling data set composed of the first terminal identifier, the first protection strategy sequence and the first security report is sent to the policy distribution module; The abnormal prediction model is used to perform abnormal attack prediction processing according to the first monitoring data set to obtain the corresponding first abnormal prediction vector and send it back to the model scheduling module; the first abnormal prediction vector is composed of multiple first abnormal prediction probabilities; each of the first abnormal prediction probabilities corresponds to a type of network attack event; The multi-task large language model is used to perform threat event identification processing according to the threat event identification instruction text to obtain the corresponding first threat event sequence and send it back to the model scheduling module; the multi-task large language model is also used to perform protection strategy generation processing according to the protection strategy generation instruction text and the strategy knowledge base to obtain the corresponding first protection strategy sequence and send it back to the model scheduling module; the multi-task large language model is also used to perform security report generation processing according to the security report generation instruction text to obtain the corresponding first security report and send it back to the model scheduling module; when the first threat event sequence is not empty, it is composed of one or more first threat event types; when the first protection strategy sequence is not empty, it is composed of one or more first protection strategy types; The policy knowledge base is used to store multiple first policy knowledge records; the first policy knowledge record consists of a first policy type and a first event type set; each of the first policy types is a protection policy type; the first event type set consists of one or more first event types, and each of the first event types is a threat event type; The policy distribution module is used to send the first terminal identifier and the first protection policy sequence of the first scheduling data set to the policy implementation module; and send the first security report of the first scheduling data set to a preset notification interface; The policy implementation module is used to perform protection policy response processing on the designated network terminal corresponding to the first terminal identifier according to the first protection policy sequence.

2. The network security protection system introducing an artificial intelligence model according to claim 1 is characterized in that: The designated network terminal includes any type of network resource facilities, including at least a network module, a network device, a network equipment, a network service interface / microservice interface, a network virtual machine, a network database, a network server, a network platform, a network system and a network cloud; The first flow record sequence is formed by sorting a plurality of the first flow records in chronological order; the first flow record includes a first monitoring time, a first monitoring port, a first monitoring protocol type and a first monitoring flow; the first monitoring port is an IP address port; The first monitoring protocol type is a network data transmission protocol at the bottom layer or application layer; The first monitoring traffic is the monitoring data traffic corresponding to the current monitoring protocol on the current monitoring port at the current monitoring time; The first service record sequence is formed by sorting a plurality of the first service records in chronological order; the first service record includes a second monitoring time, a first monitoring address, a first monitoring service type and a first monitoring service parameter; the first monitoring address is a URL address of a service; the first monitoring service type is a type of service application; the first monitoring service parameter is a service application parameter corresponding to the current monitoring service type at the current monitoring address at the current monitoring time; The first log record sequence is formed by sorting a plurality of the first log records in chronological order; the first log record includes a third monitoring time, a first monitoring device identifier and a first monitoring log; the first monitoring device identifier is a unique device identifier of a network device; The first monitoring log is a device operation log generated on the current network device during the current monitoring time.

3. The network security protection system introducing an artificial intelligence model according to claim 1 is characterized in that: The abnormality prediction model is a customized deep learning model; the model structure of the abnormality prediction model consists of a first encoding module, a second encoding module, a third encoding module, a first CNN network, a second CNN network, a third CNN network, a first pooling layer, a second pooling layer, a third pooling layer, a first fully connected layer, a second fully connected layer, a third fully connected layer, a first feature fusion module and a first MLP network; The input end of the first encoding module is used to receive the corresponding first traffic record sequence, and the output end is connected to the input end of the first CNN network; The input end of the second encoding module is used to receive the corresponding first service record sequence, and the output end is connected to the input end of the second CNN network; the input end of the third encoding module is used to receive the corresponding first log record sequence, and the output end is connected to the input end of the third CNN network; the output ends of the first, second and third CNN networks are respectively connected to the input ends of the corresponding first, second and third pooling layers; the output ends of the first, second and third pooling layers are respectively connected to the input ends of the first, second and third fully connected layers; the output ends of the first, second and third fully connected layers are respectively connected to the first, second and third input ends of the first feature fusion module; the output end of the first feature fusion module is connected to the input end of the first MLP network; the output end of the first MLP network is used to output the corresponding first abnormality prediction vector; The first encoding module is used to remove punctuation marks from each of the first traffic records in the first traffic record sequence to obtain a corresponding first punctuation-free text; and perform word segmentation processing on each of the first punctuation-free texts to obtain a corresponding first word segmentation sequence; and perform word embedding encoding processing on each of the first word segmentation sequences to obtain a corresponding first word encoding vector; and form a corresponding first encoding tensor composed of all the obtained first word encoding vectors and send it to the first CNN network; The second encoding module is used to remove punctuation marks from each of the first service records in the first service record sequence to obtain a corresponding second punctuation-free text; and perform word segmentation processing on each of the second punctuation-free texts to obtain a corresponding second word segmentation sequence; and perform word embedding encoding processing on each of the second word segmentation sequences to obtain a corresponding second word encoding vector; and form a corresponding second encoding tensor composed of all the obtained second word encoding vectors and send it to the second CNN network; The third encoding module is used to remove punctuation marks from each of the first log records in the first log record sequence to obtain a corresponding third punctuation-free text; and perform word segmentation processing on each of the third punctuation-free texts to obtain a corresponding third word segmentation sequence; and perform word embedding encoding processing on each of the third word segmentation sequences to obtain a corresponding third word encoding vector; and form a corresponding third encoding tensor composed of all the obtained third word encoding vectors and send it to the third CNN network; The first, second and third CNN networks are each composed of multiple convolutional layers; the first CNN network is used to perform feature extraction processing on the first coding tensor to obtain the corresponding first feature tensor and send it to the first pooling layer; the second CNN network is used to perform feature extraction processing on the second coding tensor to obtain the corresponding second feature tensor and send it to the second pooling layer; the third CNN network is used to perform feature extraction processing on the third coding tensor to obtain the corresponding third feature tensor and send it to the third pooling layer; The first pooling layer is used to perform feature dimensionality reduction processing on the first feature tensor according to the preset pooling strategy to obtain the corresponding first dimensionality reduction feature and send it to the first fully connected layer; the second pooling layer is used to perform feature dimensionality reduction processing on the second feature tensor according to the preset pooling strategy to obtain the corresponding second dimensionality reduction feature and send it to the second fully connected layer; the third pooling layer is used to perform feature dimensionality reduction processing on the third feature tensor according to the preset pooling strategy to obtain the corresponding third dimensionality reduction feature and send it to the third fully connected layer; the preset pooling strategy includes a maximum pooling method and an average pooling method; The first fully connected layer is used to perform one-dimensional vector conversion on the first dimension reduction feature to obtain a corresponding first feature vector and send it to the first feature fusion module; the second fully connected layer is used to perform one-dimensional vector conversion on the second dimension reduction feature to obtain a corresponding second feature vector and send it to the first feature fusion module; the third fully connected layer is used to perform one-dimensional vector conversion on the third dimension reduction feature to obtain a corresponding third feature vector and send it to the first feature fusion module; the output vector lengths of the first, second and third fully connected layers are kept consistent; The first feature fusion module is used to perform weighted sum processing on the first, second and third feature vectors and send the obtained result vector as the corresponding first fusion vector to the first MLP network; The first MLP network is composed of multiple fully connected layers; the first MLP network is used to predict the occurrence probabilities of multiple types of network attack events according to the first fusion vector to obtain the corresponding first anomaly prediction vector.

4. The network security protection system introducing an artificial intelligence model according to claim 3 is characterized in that: Before the model is applied, the abnormality prediction model is trained based on a preset first model data set in a supervised model training manner; after the model is applied, the abnormality prediction model is regularly fine-tuned based on the latest second model data set in a supervised model training manner; The first model data set is composed of a plurality of first data records; the first data record is composed of a first training traffic record sequence, a first training service record sequence, a first training log record sequence, and a first abnormal label vector; the first abnormal label vector is composed of a plurality of first abnormal label probabilities; each of the first abnormal label probabilities corresponds to a type of network attack event; the value of each of the first abnormal label probabilities is set to 0 or 1; The second model data set consists of a plurality of second data records; the second data record consists of a second training traffic record sequence, a second training service record sequence, a second training log record sequence, and a second abnormal label vector; the second abnormal label vector consists of a plurality of second abnormal label probabilities; each of the second abnormal label probabilities corresponds to a type of network attack event; the value of each of the second abnormal label probabilities is set to 0 or 1; The data timeliness of the second model dataset is better than that of the first model dataset; and the total number of records of the second model dataset is less than that of the first model dataset.

5. The network security protection system introducing an artificial intelligence model according to claim 1 is characterized in that: The multi-task large language model is implemented based on a large language model that has been pre-trained using a public natural language corpus; the large language model includes at least a GPT series model and a BERT series model; The natural language instruction template of the multi-task large language model includes at least three types of task instruction templates, namely, the threat event identification task instruction template, the protection strategy generation task instruction template and the security report generation task instruction template; The threat event identification task instruction template is a formatted natural language instruction template of the multi-task large language model; the threat event identification task instruction template is used to use the first traffic record sequence, the first service record sequence and the first log record sequence of the first monitoring data set input by the template as the corresponding current traffic time series data set, the current service time series data set and the current log time series data set; Each of the first abnormal prediction probabilities of the first abnormal prediction vector input by the template and the corresponding network attack event are combined into a corresponding network attack prediction data, and all the obtained network attack prediction data are combined into a corresponding current network attack prediction data set; and based on a preset narrative natural language text, the multi-task large language model is required to perform threat event identification processing according to the current traffic time series data set, the current service time series data set, the current log time series data set and the current network attack prediction data set, and the multi-task large language model is required to assemble the output sequence of all identified threat event types according to a preset text output sequence structure to obtain the corresponding first threat event sequence and output it; The protection strategy generation task instruction template is a formatted natural language instruction template of the multi-task large language model; the protection strategy generation task instruction template is used to take the first threat event sequence input by the template as the corresponding current threat event sequence; and based on a preset narrative natural language text, the multi-task large language model is required to search the policy knowledge base for the protection strategy type that best matches each of the first threat events in the current threat event sequence, and remove duplicates and combine all the obtained protection strategy types to obtain the corresponding optimal protection strategy type combination, and the multi-task large language model is required to assemble the identified optimal protection strategy type combination into an output sequence according to a preset text output sequence structure to obtain the corresponding first protection strategy sequence and output it; The security report generation task instruction template is a formatted natural language instruction template of the multi-task large language model; the security report generation task instruction template is used to use the first terminal identifier, the first monitoring data set, the first abnormal prediction vector and the first protection strategy sequence input by the template as the corresponding current terminal identifier, current monitoring data set, current abnormal prediction vector and current protection strategy sequence; and each of the first abnormal prediction probabilities of the current abnormal prediction vector and the corresponding network attack event constitute a corresponding network attack prediction data, and all the obtained network attack prediction data constitute a corresponding current network attack prediction data set; and taking a preset safety report text structure template as the corresponding current text structure template; Based on a preset narrative natural language text, the multi-task large language model is required to bring the current terminal identification, the current monitoring data set, the current network attack prediction data set and the current protection strategy sequence into the current text structure template for report text assembly and generation processing, and output the final generated text as the corresponding first security report.

6. The network security protection system introducing an artificial intelligence model according to claim 5 is characterized in that: Before the model is applied, the threat event identification task processing parameters of the multi-task large language model are fine-tuned based on the preset third model data set in a supervised model training manner; before the model is applied, the protection strategy generation task processing parameters of the multi-task large language model are fine-tuned based on the preset fourth model data set and the policy knowledge base in a supervised model training manner; before the model is applied, the security report generation task processing parameters of the multi-task large language model are fine-tuned based on the preset fifth model data set in a supervised model training manner; after the model is applied, the threat event identification task processing parameters of the multi-task large language model are regularly fine-tuned based on the latest sixth model data set in a supervised model training manner; Wherein, the third model data set is composed of multiple third data records; the third data record is composed of a third training traffic record sequence, a third training service record sequence, a third training log record sequence, a fifth training anomaly prediction vector and a first threat event label sequence; the first threat event label sequence is composed of multiple first threat event type labels; The fourth model data set is composed of a plurality of fourth data records; the fourth data record is composed of a first training threat event sequence and a first protection strategy label sequence; the first protection strategy label sequence is composed of a plurality of first protection strategy type labels; The fifth model data set is composed of a plurality of fifth data records; the fifth data record is composed of a first training terminal identifier, a first training monitoring data set, a sixth training anomaly prediction vector, a first training protection strategy sequence and a first label safety report; The sixth model data set consists of a plurality of sixth data records; the sixth data record consists of a fourth training traffic record sequence, a fourth training service record sequence, a fourth training log record sequence, a seventh training anomaly prediction vector, and a second threat event label sequence; the second threat event label sequence consists of a plurality of second threat event type labels; The data timeliness of the sixth model data set is better than that of the third model data set; the total number of records of the sixth model data set is less than that of the third model data set.

Images