Language model-based IP intelligence identification method and apparatus, and electronic device

Abstract

The invention relates to the technical field of computer networks, in particular to an IP intelligence recognition method and device based on a language model and electronic equipment. The method comprises the following steps: acquiring IP network data; querying the IP network data to obtain an IP network data query result; predefining a query instruction template; constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template; and inputting the query instruction into a pre-trained language model to carry out IP intelligence identification so as to obtain an IP intelligence identification result. According to the embodiment of the invention, the IP intelligence identification method based on the language model has the characteristics of automation and intelligence in the processes of collecting data, processing the data by using the language model and the like, plays an important role in a plurality of key fields such as network security, data center management and the like, and provides solid technical support for the progress of the fields.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and more specifically, to a method, device, and electronic device for identifying IP intelligence based on a language model. Background Art

[0002] In today's Internet age, IP (Internet Protocol) intelligence plays a vital role. It helps security experts identify IP addresses that may carry malicious intent or IPs that have been confirmed as attack sources, enabling companies to take quick action, such as blocking communications with these suspicious IPs, thereby effectively reducing the risk of data leakage or system damage. Due to the dynamic allocation of IP addresses and complex network structures, it is a challenge to quickly obtain accurate and effective IP intelligence.

[0003] Existing IP intelligence identification technology is based on a small amount of massive data with high lag, has low accuracy and is difficult to respond to dynamic changes in the network in real time. Summary of the invention

[0004] The present invention aims to overcome at least one defect (shortcoming) of the above-mentioned prior art and provide an IP intelligence identification method, device, and electronic device based on a language model to achieve the effect of improving the efficiency of obtaining IP intelligence.

[0005] According to the first aspect of the present application, a method for identifying IP intelligence based on a language model is provided;

[0006] Get IP network data;

[0007] Querying the IP network data to obtain the IP network data query result;

[0008] Predefined query command templates;

[0009] Constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template;

[0010] The query instruction is input into the pre-trained language model to perform IP intelligence recognition to obtain the IP intelligence recognition result.

[0011] According to the language model-based IP intelligence identification method, the acquired IP network data can be processed, and a predefined query instruction template can be set. The predefined query instruction template can form a valid query instruction. According to the query instruction, the IP network data is identified in the pre-trained language model to obtain the IP intelligence identification result.

[0012] Optionally, the predefined query instruction template includes an instruction format of a query task and an instruction format of a query result;

[0013] Constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template, specifically comprising:

[0014] Constructing a query task instruction corresponding to the IP network data query result according to the instruction format of the query task;

[0015] A query result instruction corresponding to the IP network data query result is constructed according to the instruction format of the query result.

[0016] The query task instruction and the query result instruction are derived from a predefined query instruction template, with a standardized format and specific content. The IP network data query result obtains the relevant information of the IP network data, provides sufficient and specific identification basis for the identification task, and can realize fast and high-accuracy identification of the IP network data.

[0017] Optionally, the IP intelligence identification result includes an IP intelligence query result corresponding to the IP network data and an identification basis corresponding to the result.

[0018] The IP intelligence identification results can well describe the relevant detailed information of the IP network data. IP intelligence identification can make more accurate judgments by providing detailed information about the IP network data. This identification result is usually intuitive and easy to understand. Through the IP intelligence identification results, the geographical location of the IP address, the autonomous system (AS) to which it belongs, registration information, historical behavior patterns, etc. can be identified. This information helps network security teams assess potential network threats, optimize network performance, and make network plans and decisions. IP intelligence identification is a powerful tool that helps organizations and individuals make more informed network-related decisions by providing in-depth insights into network data.

[0019] Optionally, the pre-training process of the language model includes:

[0020] Collect IP network data samples;

[0021] Querying each of the IP network data samples to obtain an IP network data query result corresponding to each of the IP network data samples;

[0022] Preset error correction instruction templates and language models;

[0023] Inputting the IP network data query results corresponding to each of the IP network data samples into the language model one by one for training to obtain the corresponding IP intelligence recognition results;

[0024] Wherein, whether the IP intelligence identification result is correct is judged, and if it is judged to be wrong, the error correction instruction template is used to construct the error correction instruction of the corresponding IP network data sample, and the error correction instruction is input into the language model, and the corresponding IP network data sample is re-trained to obtain a new IP intelligence identification result of the corresponding IP network data sample, and the new IP intelligence identification result is re-judged whether the IP intelligence identification result is correct;

[0025] If the judgment is correct, then the training of the next IP network data sample is performed;

[0026] After training all the IP network data samples, the labeling information of all the IP network data samples is obtained, and a language model including the labeling information of all the IP network data samples is obtained, thereby completing the pre-training of the language model.

[0027] The pre-training can avoid training from scratch and reduce data dependence. When data is sparse, pre-training can better capture patterns in the data and train on multiple tasks at the same time to improve the generalization ability of the model. The cost of developing and training new models can be reduced, and the accuracy of model recognition and data processing efficiency can be effectively improved.

[0028] Optionally, the error correction instruction template includes an instruction format for judging an error basis and an instruction format for re-judgment.

[0029] The use of the error correction instruction template to construct the corresponding error correction instruction of the IP network data sample specifically includes:

[0030] Constructing a corresponding instruction for judging an error based on an IP network data sample by using the instruction format for judging an error based on an instruction;

[0031] The re-judgment instruction format is used to construct a re-judgment instruction of the corresponding IP network data sample.

[0032] The pre-trained language model can learn deeper feature representations through training on a large amount of data, and has a certain feature foundation, so that it can perform better on specific tasks, even when there is less data, and can perform well, reducing the consumption of computing resources and time, making the training process more efficient. The error correction instructions can be used to continuously optimize the model and obtain more accurate results.

[0033] Optionally, the acquiring IP network data includes:

[0034] Get web page information containing IP network data;

[0035] Cutting the web page information containing the IP network data to obtain cut web page information;

[0036] A regular expression is set to extract the IP network data in the cut web page information.

[0037] Cutting the web page information containing IP network data can make the huge web page information into easy-to-process fragments, and at the same time can improve the accuracy of obtaining information and prevent other information from being filtered out.

[0038] Optionally, querying the IP network data to obtain the IP network data query result specifically includes:

[0039] Set query frequency;

[0040] Querying the IP network data using the Border Gateway Protocol;

[0041] The IP network data query result is obtained according to the query.

[0042] The setting of the query frequency can avoid being restricted or blocked by the server due to too frequent queries, and standardizes the query process. The border gateway protocol can ensure that data can be transmitted between networks along the best path, maintaining the stability and reliability of the network, which reduces the bandwidth occupied by route propagation and improves the efficiency of route updates, which is crucial to maintaining the stability and efficiency of the Internet.

[0043] According to a second aspect of the present application, there is provided an IP intelligence identification device based on a language model, comprising:

[0044] Acquisition module, used to acquire IP network data;

[0045] A query module, used for querying the IP network data to obtain the IP network data query result;

[0046] A predefined query instruction module, used for predefined query instruction templates;

[0047] A construction module, used to construct a query instruction corresponding to the IP network data query result according to the predefined query instruction template;

[0048] The recognition module is used to input the query instruction into the pre-trained language model to perform IP intelligence recognition to obtain the IP intelligence recognition result.

[0049] The IP intelligence identification device based on the language model, each module is an indispensable part of the whole process, and the modules cooperate with each other. The IP intelligence data is obtained through the acquisition module, and then the IP network data is queried through the query module to obtain the IP network data query result. The predefined query instruction template is obtained according to the predefined query instruction module, and the format of the instruction is standardized. In the construction module, the query instruction corresponding to the IP network data query result is constructed according to the predefined query instruction template. The query instruction arrives at the identification module, and the query instruction is input into the pre-trained language model to perform IP intelligence identification to obtain the IP intelligence identification result.

[0050] According to a third aspect of the present application, an electronic device is provided, including:

[0051] a memory for storing one or more computer programs;

[0052] The processor implements the language model-based IP intelligence identification method described in the first aspect when the one or more computer programs are executed by the processor.

[0053] The electronic device provides a complete set of equipment, which is convenient for realizing IP intelligence recognition and confirming IP network data related information. The equipment processes the IP network data quickly and accurately.

[0054] According to the fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a language model-based IP intelligence identification method described in the first aspect when executed.

[0055] Based on any of the above aspects, the embodiment of the present application provides an IP intelligence identification method, device, electronic device and computer storage medium based on a language model, which proposes an innovative solution for IP intelligence identification. By realizing the automatic collection and update of IP network data, this solution significantly improves the update speed and application value of intelligence. At the same time, the introduction of language large model technology breaks through the limitations of manual review and realizes the rapid, automatic and high-precision judgment of IP attribution and nature. The automated data collection and processing mechanism greatly reduces information delays and greatly enhances the instant response capability and timeliness of IP intelligence. Relying on massive data and advanced language models, the accuracy of the decision-making process has been significantly improved and the error rate has been greatly reduced. The solution design is flexible and can easily adapt to more data sources and more complex logical judgments, showing good adaptability and flexibility. When processing large amounts of data, it significantly reduces the dependence on human resources and improves work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 A schematic diagram of an application scenario of a language model-based IP intelligence identification method provided in this embodiment.

[0058] Figure 2 A flowchart of a language model-based IP intelligence identification method provided in this embodiment.

[0059] Figure 3 A schematic diagram of the sub-steps of step S150 of the language model-based IP intelligence identification method provided in this embodiment.

[0060] Figure 4 A schematic diagram of the functional modules of a language model-based IP intelligence identification device provided in this embodiment.

[0061] Figure 5 A schematic diagram of the structure of an electronic device provided in this embodiment. DETAILED DESCRIPTION

[0062] The drawings of this application are only used for illustrative purposes and should not be construed as limiting the present application. In order to better illustrate the following embodiments, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product; it is understandable to those skilled in the art that some well-known structures and their descriptions in the drawings may be omitted.

[0063] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0064] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0065] Existing IP intelligence techniques mainly involve querying static databases and manually collating information. Analysts generally collect IP-related information from multiple sources, such as various public or private IP address databases, blacklists, and reputation rating systems. This process mainly relies on database queries and requires manual review and screening of information in order to grasp the specific ownership and attributes of the IP address. This method has some obvious shortcomings, such as slow update speed, limited processing capacity, unsuitable for processing massive data, and difficulty in tracking rapid changes in the network in real time.

[0066] This embodiment provides a technical solution that can solve the above-mentioned problem. The specific implementation methods of this application are described in detail below in conjunction with the accompanying drawings.

[0067] For example, a schematic diagram of an application scenario of a language model-based IP intelligence identification method provided in an embodiment of the present application is provided. Figure 1 As shown, the application scenario includes at least a server 100 and a terminal 200 that can communicate with the server 100. Both the server 100 and the terminal device 200 have functions such as obtaining network address information and storing network address information, and also have functions such as classifying and identifying stored network information.

[0068] It is understandable that the server 100 can be an independent electronic device or a cluster of multiple electronic devices; the terminal 200 can be a smart phone terminal, a personal computer, a tablet computer, a car terminal, etc., but is not limited thereto.

[0069] In one practicable manner, the server 100 and the terminal 200 can respectively execute a language model-based IP intelligence identification method provided in an embodiment of the present application, or, optionally, an embodiment of the present application provides a language model-based IP intelligence identification method that is partially executed in the server 100 and partially executed in the terminal 200.

[0070] like Figure 2As shown, this embodiment provides an IP intelligence identification method based on a language model, which may include the following steps:

[0071] S110, obtaining IP network data;

[0072] In this embodiment, the IP network data may include an IP address, a port number, a MAC address (Media Access Control Address), an IP datagram header, an open port, a geographic location, an ASN (Autonomous System Number), and related resolved domain names.

[0073] In an optional implementation, the IP network data needs to access the web page containing the IP network data to obtain the original HTML (Hyper Text Markup Language) data, by using Python's request library, initiating a GET request to the target URL (uniform resource locator), and using the HTTP (Hyper Text Transfer Protocol) response status code to obtain the original HTML data. In the process of obtaining data, the HTTP response status code is checked. If the request is unsuccessful, the data cannot be obtained and the program needs to be terminated. The obtained data is cut and located to the part containing useful data, and then the useful data part is extracted to obtain the IP network data. The method for obtaining IP network data is not limited.

[0074] Optionally, set a regular expression to match and extract the ASN and associated IP information in the web page. Set two regular expressions, one for extracting lines with ASN tags and the other for identifying data in CIDR (Classless Inter-Domain Routing) format. In specific implementation, it is necessary to traverse the processed HTML content and apply regular expressions to match and extract information line by line. When the ASN-tagged content is matched, the ASN-related data needs to be further processed; for the match of CIDR format data, it is stored in a list for subsequent operations. The method for obtaining IP network data is not limited here.

[0075] In this embodiment, the web page containing IP network data includes Internet Protocol address (IP Address Details), IP geographic location (IP Geolocation), WHOIS Lookup (WHOIS Lookup), IP2Location, MaxMind, CIDR Report, etc.

[0076] Exemplarily, the web page information containing the IP network data is obtained by accessing CIDR Report, and the automatic update script is edited to regularly summarize and update the web page data. The websites from which the data comes include but are not limited to these.

[0077] S120, querying the IP network data to obtain the IP network data query result;

[0078] In this embodiment, the IP network data is queried using an online IP query tool, a command line tool, a network configuration interface, a geographic location marker technology, etc. The IP network data query results include geographic location, time zone, Internet service provider (ISP), domain name, WHOIS information, etc.

[0079] In an optional implementation, information related to the ASN is queried through the WHOIS protocol, a query frequency is set, the collected IP network data is queried using the WHOIS protocol to obtain information such as users and related contacts registered under the domain name registry, network number or ASN, and the WHOIS protocol is parsed to obtain information related to the ASN. The query method and query results are not limited to this.

[0080] In a more preferred implementation, the WHOIS protocol is usually parsed in text format. Different WHOIS servers (such as APNIC-Asia Pacific, LACNIC-Latin America, AFRINIC-Africa, RIPE-Europe, ARIN-North America) have different text formats, so different parsing rules are customized for data from different sources: for APNIC, RIPE, LACNIC, and AFRINIC, the data starts when the aut-num field is encountered, and the end is marked when the source field is encountered; for ARIN, the start is marked when the ASNumber field is encountered, and the end is marked when the Ref field is encountered.

[0081] S130, pre-define query instruction template;

[0082] In this embodiment, the predefined query instruction template includes multiple task instruction formats such as the instruction format of the query task and the instruction format of the query result.

[0083] In an optional implementation, the task instruction is constructed by using the instruction format of the query task and the instruction format of the query result in the predefined query instruction template. The task instruction format includes but is not limited to this and is not specifically limited.

[0084] S140, constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template;

[0085] In this embodiment, the query instruction may be constructed according to the predefined query instruction template, or may be constructed arbitrarily according to the task to be implemented.

[0086] In an optional implementation, constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template specifically includes:

[0087] Constructing a query task instruction corresponding to the IP network data query result according to the instruction format of the query task;

[0088] A query result instruction corresponding to the IP network data query result is constructed according to the instruction format of the query result.

[0089] By constructing the instruction format of the query task, the corresponding query task instruction can be quickly and conveniently constructed according to the IP network data query result, so that it can be quickly and conveniently input into the language model for recognition. At the same time, the instruction format of the query structure can constrain the feedback of the language model on the recognition result, so that the query result can be output in a standardized manner.

[0090] S150, inputting the query instruction into the pre-trained language model to perform IP intelligence recognition to obtain an IP intelligence recognition result.

[0091] In this embodiment, the language model may be pre-trained or not, and the IP intelligence recognition result includes the IP intelligence query result corresponding to the IP network data and the identification basis corresponding to the result. The IP intelligence query result corresponding to the IP network data includes the ASN registration information of multiple countries, the user and related contact information of the IP registered under the domain name registration bureau, network number or ASN (autonomous system number). The IP network data type is determined according to the IP intelligence query result corresponding to the IP network data, and the identification basis corresponding to the result is given.

[0092] In an optional embodiment, illustratively, Figure 3 This embodiment provides a schematic diagram of sub-steps of step S150 of a method for identifying IP intelligence based on a language model. The specific steps of step S150 may include:

[0093] S151, collecting IP network data samples;

[0094] S152, querying each of the IP network data samples to obtain an IP network data query result corresponding to each of the IP network data samples;

[0095] S153, preset error correction instruction template and language model;

[0096] S154, inputting the IP network data query results corresponding to each of the IP network data samples into the language model one by one for training to obtain the corresponding IP intelligence recognition results;

[0097] Wherein, whether the IP intelligence identification result is correct is judged, and if it is judged to be wrong, the error correction instruction template is used to construct the error correction instruction of the corresponding IP network data sample, and the error correction instruction is input into the language model, and the corresponding IP network data sample is re-trained to obtain a new IP intelligence identification result of the corresponding IP network data sample, and the new IP intelligence identification result is re-judged whether the IP intelligence identification result is correct;

[0098] If the judgment is correct, then the training of the next IP network data sample is performed;

[0099] After training all the IP network data samples, the labeling information of all the IP network data samples is obtained, and a language model including the labeling information of all the IP network data samples is obtained, thereby completing the pre-training of the language model.

[0100] In this embodiment, during the training process using the language model in step S154, the language model may have recognition errors in the IP intelligence recognition results corresponding to the IP network data samples. Therefore, a judgment is added on whether the IP intelligence recognition results output by the language model are correct. When the IP intelligence recognition results output by the language model are an erroneous result, the corresponding IP network data samples are retrained using the error correction instructions. The error correction instructions may specifically include the reason for judging whether the IP intelligence recognition results are correct and instructions for re-performing IP intelligence recognition. Thus, the language model can obtain erroneous experience in result recognition through the error correction instructions, and then re-perform result recognition to improve the recognition accuracy of the language model.

[0101] The language model may adopt an AI intelligent language model, which may have a strong natural language processing capability and the ability to understand complex texts, and may accurately identify through constructed query task instructions and error correction instructions, and may also feedback the identification result according to the query result instruction. The language model may be pre-trained to enable the language model to learn the ability to identify IP network data in advance through training with a large number of samples.

[0102] Preferably, when the language model relies on context clues, the recognition process of relevant samples and the IP intelligence recognition results can be obtained through training of the large number of samples, so that the language model can form context clues and further improve the recognition accuracy.

[0103] For example, a language model-based IP intelligence identification method of the present application can be used to identify IP network data, thereby determining whether the ASN belongs to a data center. In specific implementation, there are more than 70,000 ASNs collected from CIDR-Report, of which 460 are identified as data centers. By comparing the pure IP of well-known domestic open source IP intelligence, it can be found that the method of the present application can discover data centers that are not discovered by pure IP, such as:

[0104] (1)AS7595, the corresponding registered organization is READYSPACE-SG Ready space Cloud Services, which is a data center

[0105] (2) AS7603, the corresponding registered organization is GENECOMPUTINGLTD-AS-AP Gene Computing Ltd, Data Center

[0106] (3)AS4892, the corresponding registration organization is APPLIEDUK-CLOUD-04, data center, etc.

[0107] Exemplarily, the present application can use automated scripts to collect IP network data from the CIDR-Report website. The CIDR-Report website is usually updated once a day. High-frequency updates can provide near-real-time network routing status, and its data coverage is very wide. The automated data collection and processing process shortens the delay of information, which greatly improves the response speed and timeliness of IP intelligence. The collected IP network data is combined with a language model to identify IP intelligence, such as determining the type of ASN registration organization, and identifying the sorted WHOIS information to accurately determine the attributes of the ASN, such as whether it belongs to a data center, an educational institution, or a corporate dedicated line. The use of query instruction templates and error correction templates enables the language model to better adapt to specific tasks, and can continuously optimize the judgment instructions based on the recognition results, making the judgment more accurate, with a lower error rate, and can be easily extended to more data sources and more complex judgment logics, with good flexibility and adaptability, greatly reducing the investment in human resources, and the effect is particularly obvious when processing large-scale data. The design of the present application allows for flexible expansion of new data sources and language models, so that the system can continuously adapt to new security requirements and technological developments, and maintain long-term applicability and effectiveness.

[0108] Automated and intelligent processing reduces the reliance on professionals and reduces labor costs. At the same time, fast and accurate IP intelligence can help enterprises respond to security threats in a timely manner and avoid possible economic losses, thereby improving overall cost-effectiveness.

[0109] like Figure 4 As shown, the embodiment of the present application further provides a language model-based IP intelligence identification device 210. Optionally, the language model-based IP intelligence identification device 210 may include:

[0110] An acquisition module 211 is used to acquire IP network data;

[0111] In this embodiment, the acquisition module 211 can be used to execute Figure 2 As shown in step S110, for the specific description of the acquisition module 211, reference may be made to the description of step S110.

[0112] A query module 212, configured to query the IP network data to obtain the IP network data query result;

[0113] In this embodiment, the query module 212 can be used to perform Figure 2 As shown in step S120, for a detailed description of the query module 212, reference may be made to the description of step S120.

[0114] A predefined query instruction module 213, used for predefining query instruction templates;

[0115] In this embodiment, the predefined query instruction module 213 can be used to execute Figure 2 As shown in step S130, for a detailed description of the predefined query instruction module 213, reference may be made to the description of step S130.

[0116] A construction module 214, configured to construct a query instruction corresponding to the IP network data query result according to the predefined query instruction template;

[0117] In this embodiment, the construction module 214 can be used to execute Figure 2 As shown in step S140, for the detailed description of the construction module 214, reference may be made to the description of the step S140.

[0118] The identification module 215 is used to input the query instruction into the pre-trained language model to perform IP intelligence identification to obtain the IP intelligence identification result.

[0119] In this embodiment, the identification module 215 can be used to perform Figure 2 As shown in step S150, for the detailed description of the identification module 215, reference may be made to the description of step S150.

[0120] It can be understood that the above-mentioned device embodiment and the above-mentioned method embodiment can correspond to each other, and similar descriptions of the device embodiment can refer to the method embodiment. To avoid repetition, it will not be repeated here. The IP intelligence identification device based on a language model provided in the embodiment of the present application can execute the IP intelligence identification method based on a language model provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects of the execution method. The functional modules of the IP intelligence identification device based on a language model can be implemented in the form of hardware, can be implemented by instructions in the form of software, and can also be implemented by a combination of hardware and software modules.

[0121] Specifically, each step of the method embodiment of the present application can be completed by the hardware integrated logic circuit and / or software instructions in the processor. The steps of a language model-based IP intelligence identification method in combination with the embodiment of the present application can be directly embodied as a hardware encoding processor, or a combination of hardware and software modules in the encoding processor. Optionally, the software module can be located in a random access memory, a read-only memory, a programmable read-only memory, a flash memory, an electrically erasable programmable memory, a register, and other storage media. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in combination with its hardware.

[0122] The present application embodiment provides an electronic device 710, whose structure is as follows: Figure 5 The electronic device 710 may be Figure 1 The server 100 or the terminal 200 is shown.

[0123] like Figure 5 As shown, the electronic device 710 includes a memory 711, a processor 712, a communication module 713 and an input / output interface 714, etc. Optionally, the memory 711, the processor 712, the communication module 713 and the input / output interface 714 can be connected and communicated through a bus 715.

[0124] The memory 711 is used to store one or more computer programs and transfer the code of the computer program to the processor 712; when the one or more computer programs are executed by the processor 711, a language model-based IP intelligence identification method in an embodiment of the present application is implemented.

[0125] Optionally, the electronic device 710 can be connected to a network via a communication module 713 to communicate with other devices, such as a terminal or a server, through the network to achieve data interaction. The electronic device 710 can be various forms of digital computers, such as desktop computers, servers, workstations, mainframe computers or other types of computers. The electronic device 710 can also be various forms of mobile terminals, such as smart phones, tablet computers, wearable devices (such as helmets, glasses, watches, etc.) and other similar mobile terminals.

[0126] Optionally, the electronic device 710 can be connected to the required input / output devices, such as a keyboard, a display device, etc., through the input / output interface 714. The electronic device 710 itself can have a display device, and can also be connected to other display devices through the input / output interface 714. Optionally, a storage device, such as a hard disk, can also be connected through the input / output interface 714, so that data in the electronic device 710 can be stored in the storage device, or data in the storage device can be read, and data in the storage device can also be stored in the memory 711. It can be understood that the input / output interface 714 can be a wired interface or a wireless interface. Depending on the actual application scenario, the device connected to the input / output interface 714 can be a component of the electronic device 710, or it can be an external device connected to the electronic device 710 when needed.

[0127] Optionally, the memory 711 may be a volatile memory and / or a non-volatile memory, the volatile memory may be a random access memory, etc., and the non-volatile memory may be a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory or a flash memory, etc.

[0128] Optionally, the computer program stored in the processor 711 may be divided into one or more modules, which are stored in the memory 711 and executed by the processor 712 to complete the method provided in the embodiment. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the computer program instruction segments are used to describe the execution process of the computer program in the electronic device 710.

[0129] Optionally, the processor 712 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 712 include, but are not limited to, a central processing unit, a graphics processing unit, a digital signal processor, various special artificial intelligence computing chips, various processors running machine learning model algorithms, and any appropriate controller, microcontroller, processor, etc. The processor 712 executes the various methods and processes of this embodiment, illustratively, such as a language model-based IP intelligence identification method in an embodiment of the present application.

[0130] Optionally, the bus 715 may include a path for transmitting information. The bus 715 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. According to different functions, the bus 715 may be divided into an address bus, a data bus, a control bus, etc.

[0131] In an optional implementation, the embodiment of the present application further provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. Part or all of the computer program can be loaded and / or installed on the memory 711 of the electronic device 710. When the computer program is executed by the processor 712, one or more steps of a language model-based IP intelligence identification method of the embodiment of the present application can be performed.

[0132] Optionally, the computer-readable storage medium may be a random access memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, or the like.

[0133] Obviously, the above embodiments of the present application are merely examples for clearly illustrating the technical solution of the present application, and are not intended to limit the specific implementation methods of the present application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present application shall be included in the protection scope of the claims of the present application.

Claims

1. A method for identifying IP intelligence based on a language model, characterized in that: include: Get IP network data; Querying the IP network data to obtain the IP network data query result; Predefined query command templates; Constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template; The query instruction is input into the pre-trained language model to perform IP intelligence recognition to obtain the IP intelligence recognition result.

2. According to the method of claim 1, the method is characterized in that: The predefined query instruction template includes the instruction format of the query task and the instruction format of the query result; Constructing a query instruction corresponding to the IP network data query result according to the predefined query instruction template, specifically comprising: Constructing a query task instruction corresponding to the network data query result according to the instruction format of the query task; A query result instruction corresponding to the IP network data query result is constructed according to the instruction format of the query result.

3. The method for identifying IP intelligence based on a language model according to claim 2, characterized in that: The IP intelligence identification result includes the IP intelligence query result corresponding to the IP network data and the identification basis corresponding to the result.

4. A method for identifying IP intelligence based on a language model according to any one of claims 1 to 3, characterized in that: The pre-training process of the language model includes: Collect IP network data samples; Querying each of the IP network data samples to obtain an IP network data query result corresponding to each of the IP network data samples; Preset error correction instruction templates and language models; Inputting the IP network data query results corresponding to each of the IP network data samples into the language model one by one for training to obtain the corresponding IP intelligence recognition results; Wherein, whether the IP intelligence identification result is correct is judged, and if it is judged to be wrong, the error correction instruction template is used to construct the error correction instruction of the corresponding IP network data sample, and the error correction instruction is input into the language model, and the corresponding IP network data sample is re-trained to obtain a new IP intelligence identification result of the corresponding IP network data sample, and the new IP intelligence identification result is re-judged whether the IP intelligence identification result is correct; If the judgment is correct, then the training of the next IP network data sample is performed; After training all the IP network data samples, the labeling information of all the IP network data samples is obtained, and a language model including the labeling information of all the IP network data samples is obtained, thereby completing the pre-training of the language model.

5. The method for identifying IP intelligence based on a language model according to claim 4, characterized in that: The error correction instruction template includes an instruction format for judging the error basis and an instruction format for re-judgment. The use of the error correction instruction template to construct the corresponding error correction instruction of the IP network data sample specifically includes: Constructing a corresponding instruction for judging an error based on an IP network data sample by using the instruction format for judging an error based on an instruction; The re-judgment instruction format is used to construct a re-judgment instruction of the corresponding IP network data sample.

6. A method for identifying IP intelligence based on a language model according to any one of claims 1 to 3 and 5, characterized in that: The obtaining of IP network data comprises: Get web page information containing IP network data; Cutting the web page information containing the IP network data to obtain cut web page information; Extract the IP network data from the cut web page information.

7. A method for identifying IP intelligence based on a language model according to any one of claims 1 to 3 and 5, characterized in that: The querying of the IP network data to obtain the IP network data query result specifically includes: Set query frequency; Querying the IP network data using the Border Gateway Protocol; The IP network data query result is obtained according to the query.

8. An IP intelligence identification device based on a language model, characterized in that: The device comprises: Acquisition module, used to acquire IP network data; A query module, used for querying the IP network data to obtain the IP network data query result; A predefined query instruction module, used for predefined query instruction templates; A construction module, used to construct a query instruction corresponding to the IP network data query result according to the predefined query instruction template; The recognition module is used to input the query instruction into the pre-trained language model to perform IP intelligence recognition to obtain the IP intelligence recognition result.

9. An electronic device, characterized in that: include: a memory for storing one or more computer programs; A processor, when the one or more computer programs are executed by the processor, implements the language model-based IP intelligence identification method as described in any one of claims 1-7.

10. A computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a processor to implement the language model-based IP intelligence identification method as described in any one of claims 1 to 7 when executed.

Images