Static application security detection false alarm identification system based on LLM

Abstract

The invention relates to the technical field of data processing, and discloses a static application security detection false alarm discrimination system based on LLM; the system comprises extracting security detection data, performing deduplication processing on replaced security detection data, calculating the similarity of security detection data, constructing a vector library, calculating the real-time similarity of security detection data to be judged, screening matching data from the vector library, and interpreting the labeled data corresponding to the security detection data to be judged according to a large language interpretation model; compared with the prior art, the invention can ensure that each replaced security detection data can maintain independence and uniqueness, reduce the similarity calculation burden, save the similarity calculation time, and can accurately and quickly interpret the corresponding simple and easy-to-understand natural language from the complex and lengthy security detection data, thereby facilitating the false alarm discrimination analysis operation of the security detection data of the application program by non-professionals.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and more specifically, to a static application security detection false alarm identification system based on LLM. Background Art

[0002] Network security practitioners often need to analyze threat detection rules or security device commands during network security incident investigation and analysis. Understanding these rules or commands requires relevant professional knowledge, which places relatively high technical requirements on network security practitioners. Especially in static security detection of applications, it is necessary to combine the large language model (LLM) to perform false alarm identification operations on the application's threat detection rules and security device commands.

[0003] Large language models have strong language understanding, reasoning, and generation capabilities. However, the training corpus of large language models contains relatively few threat detection rules and security device command data, especially the private rules and commands of security vendors. Therefore, directly using large language models to interpret rules or commands is not ideal.

[0004] The patent application with reference publication number CN117077153A discloses a false positive identification method for static application security detection based on a large-scale language model, including S1: performing static application security detection to identify potential security vulnerabilities and assigning labels to potential security vulnerabilities; S2: extracting the content of each potential security vulnerability in three aspects; S3: performing three clustering analyses on all potential security vulnerabilities, and selecting typical content in each category of each aspect; S4: constructing input content in combination with the input length limit of the large-scale language model; S5: according to the label of each potential security vulnerability, forming a mapping table containing the vulnerability label and the corresponding three aspect category labels, and adding it to the input content; S6: inputting the input content into a pre-trained large-scale language model for analysis, and outputting the labels of potential security vulnerabilities that are judged to be false positives;

[0005] The existing static application security detection false alarm discrimination system obtains the overall security detection result of the application by comprehensively analyzing and judging the relevant network security impact data in the application, thereby providing data support for false alarm discrimination. For example, in the above-mentioned patent application, it can grasp the vulnerability situation from the overall and contextual perspective by extracting and classifying the key information of each potential security vulnerability, and achieve the false alarm discrimination effect of security detection. Although the analysis operation of application false alarm discrimination can be realized, the overall analysis and discrimination of network security data will not only increase the amount of data calculation in the false alarm discrimination analysis, but also a large amount of repeated and similar data will have a negative impact on the calculation results, resulting in low accuracy of subsequent false alarm discrimination, and thus unable to provide accurate and real false alarm discrimination data support for static application security detection, reducing the efficiency of static application security detection false alarm discrimination.

[0006] In view of this, the present invention proposes a static application security detection false alarm identification system based on LLM to solve the above problems. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a static application security detection false alarm identification system based on LLM, applied to a security detection platform, comprising:

[0008] A data extraction module is used to obtain historical security events of the application in a static mode and extract security detection data from the historical security events. The security detection data includes open source rule data, private rule data and security command data.

[0009] A data preprocessing module is used to mark replaceable parameters in the security detection data, replace characters of the replaceable parameters, and perform deduplication processing on the replaced security detection data;

[0010] The vector library construction module is used to vectorize the deduplicated security detection data, calculate the similarity of the security detection data, extract valid data, and construct a vector library;

[0011] The data screening module is used to obtain the security detection data to be judged, calculate the real-time similarity of the security detection data to be judged, and screen out the matching data from the vector library, and the matching data includes the primary data and the secondary data;

[0012] The interpretation and discrimination module is used to train a large language interpretation model for interpreting the labeled data based on the matching data, interpret the labeled data corresponding to the security detection data to be judged, and determine whether to issue a false alarm discrimination prompt.

[0013] Furthermore, the method for extracting the open source rule data, the private rule data and the security command data includes:

[0014] Query all historical security events of the application in static mode through the database and mark the data sets in the historical security events;

[0015] The data interpretation of each data in the data set is identified one by one through natural language processing technology, and the data interpretation is split into text interpretation and digital interpretation through word segmentation technology;

[0016] Compare the text interpretation with the open source threat text in the database, and record the data containing any open source threat text in the text interpretation as open source rule data;

[0017] Compare the text interpretation with the private threat text in the database, and record the data containing any private threat text in the text interpretation as private rule data;

[0018] The text interpretation is compared with the commonly used command texts in the database, and data containing any commonly used command texts in the text interpretation is recorded as safe command data.

[0019] Furthermore, replaceable parameters include IP addresses, domain names, times, and numbers.

[0020] Further, the method of replacing characters by replacing parameters includes:

[0021] All security detection data are read in sequence through Python, and the security detection data are converted into regular expressions to obtain real-time regular expressions;

[0022] Compare the real-time regular expression with the pre-stored IP address expression, domain name expression, time expression and numeric expression, and record the real-time regular expression that is consistent with the pre-stored IP address expression, domain name expression, time expression and numeric expression as the target expression;

[0023] Identify the parameters in the target expression one by one and obtain the IP address, domain name, time and number;

[0024] Replace the IP address, domain name, time and number with the character "*" respectively to generate the replaced security detection data.

[0025] Furthermore, the deduplication processing method of the security detection data includes:

[0026] According to different types of open source rule data, private rule data and security command data, the replaced security detection data is classified into sets to obtain an open source set, a private set and a security set;

[0027] Repeating and comparing the open source rule data, private rule data, and security command data in the open source set, the private set, and the security set in turn, and recording the repeated open source rule data, private rule data, and security command data as repeated data, to obtain first repeated data, second repeated data, and third repeated data;

[0028] The recording times of the first duplicate data, the second duplicate data and the third duplicate data are queried one by one through the timestamps, and all the recording times are arranged in sequence according to the chronological order;

[0029] The first duplicate data, the second duplicate data and the third duplicate data except the last one are deleted to obtain the deduplicated security detection data.

[0030] Furthermore, the similarity calculation method includes:

[0031] Extract the trained BERT model from Hugging Face's Transformers library;

[0032] Import the deduplicated security detection data into the tokenizer for tokenization, generate single-item words, and add CLS tags to all single-item words to obtain the tagged security detection data;

[0033] Import the labeled security detection data into the BERT model, extract the output vector corresponding to the CLS tag, and obtain A vectors;

[0034] The Euclidean distance formula is used to calculate the vector and the The distance value of a vector in multidimensional space is used to obtain the Euclidean distance;

[0035] The expression of the Euclidean distance formula is:

[0036] ;

[0037] In the formula, For the vector and the The Euclidean distance of vectors, =1,2...A, =1,2...A, For the The vector elements, For the The vector elements, is the dimension of the element;

[0038] The Euclidean distance between the vectors corresponding to any two data in the open source set, the private set, and the security set is calculated one by one, and the Euclidean distance is used as the similarity between the two security detection data to obtain P similarities.

[0039] Furthermore, the method for constructing the vector library includes:

[0040] Compare the P similarities with the preset similarity threshold one by one, record the similarity less than the preset similarity threshold as the effective similarity, and record the security detection data corresponding to the effective similarity as the effective data, to obtain Q effective data;

[0041] According to the different interpretations of the text, the Q valid data are divided into groups, and the open source valid group, the private valid group and the security valid group are obtained respectively;

[0042] Randomly extract M valid data from the open source valid group, the private valid group, and the secure valid group, and label the M valid data in turn to obtain M labeled data;

[0043] Take M valid data as Key, take the labeled data corresponding to the M valid data as Value, and import the M valid data and M labeled data into the basic library to generate a vector library.

[0044] Furthermore, the screening method of primary data and secondary data includes:

[0045] Import the security detection data to be judged into the BERT model, extract the output vector corresponding to the CLS tag, and obtain C vectors to be judged;

[0046] The Euclidean distance between the C vectors to be judged and the vectors corresponding to the Q valid data is calculated one by one by using the Euclidean distance formula to obtain D real-time similarities;

[0047] Arrange the D real-time similarities in ascending order from small to large, and record the valid data corresponding to the top three real-time similarities as primary data, and record the labeled data corresponding to the primary data as secondary data.

[0048] Furthermore, the training method of the large language interpretation model includes:

[0049] Convert the valid data corresponding to the master data into a corresponding set of feature vectors;

[0050] The feature vector is used as the input of the large language interpretation model, and the labeled data corresponding to the secondary data is used as the output of the large language interpretation model. The labeled data is used as the prediction target, and minimizing the sum of prediction errors of all training data is used as the training target. The large language interpretation model is trained, and the feature vector is divided into a training set and a test set. The training set is used to train the large language interpretation model, and the test set is used to test the large language interpretation model. The training is stopped when the sum of prediction errors converges, and the large language interpretation model that can interpret the labeled data is obtained.

[0051] Furthermore, the method for determining whether to issue a false alarm identification prompt includes:

[0052] Mark the meaning, applicable scope and conditions in the interpreted annotation data respectively, and combine the meaning, applicable scope and conditions into discrimination events accordingly to obtain E discrimination events;

[0053] Select E standard events whose meanings are consistent with the E discrimination events from the database, and compare the consistency of the E standard events with the E discrimination events respectively;

[0054] When the applicable scope and conditions of the E discrimination events are consistent with the applicable scope and conditions of the E standard events, it is determined that no false alarm discrimination prompt will be issued;

[0055] When the applicable scope and conditions of the E discrimination events are inconsistent with the applicable scope and conditions of the E standard events, it is determined that a false alarm discrimination prompt is issued.

[0056] The technical effects and advantages of the static application security detection false alarm discrimination system based on LLM of the present invention are as follows:

[0057] The present invention marks replaceable parameters in security detection data, performs character replacement on the replaceable parameters, and performs deduplication processing on the replaced security detection data, thereby ensuring that each replaced security detection data can maintain independence and uniqueness, thereby avoiding interference and influence of repeated and complex security detection data on subsequent similarity calculations, thereby improving the accuracy of static application security false alarm identification, and by vectorizing the deduplicated security detection data, calculating the similarity of the security detection data, extracting valid data, and constructing a vector library, it is possible to reduce the calculation operations of some security detection data with too close similarities, reduce the calculation burden of similarity, and also reduce the workload of subsequent data annotation, reduce the number of rules and commands in the vector library, save the time of similarity calculation, and based on matching data, train interpretation A large language interpretation model for labeled data is developed to interpret the labeled data corresponding to the security detection data to be judged, and determine whether to issue a false alarm judgment prompt. On the one hand, it can accurately and quickly interpret the corresponding simple and easy-to-understand natural language from the complex and lengthy security detection data, thereby facilitating non-professionals to perform false alarm judgment analysis operations on the security detection data of the application, and provide accurate and effective data support for subsequent false alarm judgment of static application security detection, thereby improving the efficiency of false alarm judgment of static application security detection. On the other hand, the vector library is used to provide the structure and field information of threat detection rules and security device commands for the large language model, which can assist the large language model in understanding and generating more accurate interpretations without fine-tuning the large language model, effectively reducing the cost of using the large language model to interpret threat detection rules and security device commands. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of a module of a static application security detection false alarm identification system based on LLM provided in the first embodiment of the present invention;

[0059] Figure 2 A schematic diagram of a flow chart of a false positive identification method for static application security detection based on LLM provided in the second embodiment of the present invention;

[0060] Figure 3 A schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention;

[0061] Figure 4 A schematic diagram of the structure of a computer-readable storage medium provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Example 1: Please refer to Figure 1 As shown, the static application security detection false alarm identification system based on LLM described in this embodiment is applied to the security detection platform, including:

[0064] The data extraction module obtains historical security events of the application in static mode and extracts security detection data from the historical security events; the security detection data includes open source rule data, private rule data and security command data;

[0065] Static mode refers to the mode in which the application is not running, so that false positives can be detected in a timely and advance manner for potential risks in the application before the application is dynamically running;

[0066] Historical security events refer to events in which the application performed security self-checks in static mode in the past period of time, which can summarize the relevant self-check data of the application in static mode. Security detection data refers to the relevant data that can cause false positives in application security detection, and serves as the data object for subsequent false positive judgment of the application.

[0067] Specifically, the security detection data includes open source rule data, private rule data and security command data; among them, the open source rule data refers to general rules that can detect network security. For example, the open source rule data includes Suricate rules and Snort rules; private rule data refers to the private rules of security vendors that can detect network security, and the security command data refers to control instructions that can ensure network security. For example, the security command data includes firewall commands and encryption commands.

[0068] It should be noted that the security detection data of the same historical security event may contain only one of the open source rule data, private rule data and security command data, or may contain two or three of the open source rule data, private rule data and security command data. Regardless of how many types are included, the method of extracting them from the historical security events is the same;

[0069] The methods for extracting open source rule data, private rule data, and security command data include:

[0070] Query all historical security events of the application in static mode through the database and mark the data sets in the historical security events;

[0071] The data interpretation of each data in the data set is identified one by one through natural language processing technology, and the data interpretation is split into text interpretation and numerical interpretation through word segmentation technology; the data interpretation is used to concisely express the meaning of the safety detection data, so that concise information can be accurately extracted from complex and lengthy safety detection data. The text interpretation and numerical interpretation are the smallest units used to form the data interpretation, and the safety detection data are interpreted in text and numbers;

[0072] Compare the text interpretation with the open source threat text in the database, and record the data containing any open source threat text in the text interpretation as open source rule data; the open source threat text refers to the text portion corresponding to the open source rule data pre-stored in the database, which can be used as a comparison basis for the text interpretation;

[0073] Compare the text interpretation with the private threat text in the database, and record the data containing any private threat text in the text interpretation as private rule data; the private threat text refers to the text part corresponding to the private rule data pre-stored in the database, which can be used as the comparison basis of the text interpretation;

[0074] The text interpretation is compared with the commonly used command text in the database, and the data containing any commonly used command text in the text interpretation is recorded as the safe command data. The commonly used command text refers to the text part corresponding to the safe command data pre-stored in the database, which can be used as the comparison basis of the text interpretation.

[0075] It should be noted that in order to ensure that the application can contain multiple types and quantities of security detection data in static mode, it is necessary to obtain a large number of historical security events to ensure that a large amount of open source rule data, private rule data and security command data are extracted from a large number of historical security events.

[0076] The data preprocessing module marks replaceable parameters in the security detection data, performs character replacement on the replaceable parameters, and performs deduplication processing on the replaced security detection data;

[0077] Replaceable parameters refer to parameters that can represent commonly used variables in security detection data. When replaceable parameters are identified, they need to be replaced with characters so that a certain part of the security detection data can be replaced with characters. This can not only replace the data corresponding to commonly used variables to reduce the impact of these commonly used variables on subsequent calculations, but also hide some sensitive information in the security detection data.

[0078] Replaceable parameters include IP address, domain name, time and number; IP address is used to indicate the source of network activity data in the application, and can identify and locate the source of network data; domain name is used to indicate the target of network activity data request in the application; time is used to indicate the time when network activity data is generated in the application; number is used to indicate the specific value of network activity data in the application;

[0079] The methods for replacing characters with replaceable parameters include:

[0080] All security detection data are read in sequence through Python, and the security detection data are converted into regular expressions to obtain real-time regular expressions; regular expressions are used to match, search, replace or extract specific patterns in strings corresponding to security detection data, and are composed of common characters and special characters, among which metacharacters have special meanings and are used to define matching rules;

[0081] Compare the real-time regular expression with the pre-stored IP address expression, domain name expression, time expression and numeric expression, and record the real-time regular expression that is consistent with the pre-stored IP address expression, domain name expression, time expression and numeric expression as the target expression;

[0082] Identify the parameters in the target expression one by one and obtain the IP address, domain name, time and number;

[0083] Replace the IP address, domain name, time and number with the character "*" respectively to generate the replaced security detection data.

[0084] When the replaceable parameters in the security detection data are replaced, it is necessary to identify and delete the duplicate data in the replaced security detection data, so as to ensure the uniqueness and independence of the security detection data and avoid the negative impact of the duplicate data on the subsequent operations.

[0085] The deduplication processing methods for security detection data include:

[0086] According to different types of open source rule data, private rule data and security command data, the replaced security detection data is classified into sets to obtain an open source set, a private set and a security set;

[0087] Repeating and comparing the open source rule data, private rule data, and security command data in the open source set, the private set, and the security set in turn, and recording the repeated open source rule data, private rule data, and security command data as repeated data, to obtain first repeated data, second repeated data, and third repeated data;

[0088] The recording times of the first duplicate data, the second duplicate data and the third duplicate data are queried one by one through the timestamps, and all the recording times are arranged in sequence according to the chronological order;

[0089] The first duplicate data, the second duplicate data and the third duplicate data except the last one are deleted to obtain the deduplicated security detection data.

[0090] It should be noted that by deduplicating the security detection data, it is possible to ensure that each replaced security detection data can maintain independence and uniqueness, thereby avoiding interference and impact on subsequent similarity calculations, thereby improving the accuracy of static application security false alarm judgment.

[0091] The vector library construction module vectorizes the deduplicated security detection data, calculates the similarity of the security detection data, extracts valid data, and constructs a vector library.

[0092] Vectorization refers to the process of converting safety detection data into numerical vectors, so as to facilitate the subsequent understanding and processing of each specific safety detection data. It also facilitates the accurate calculation of the similarity between each safety detection data, thereby providing a reasonable and accurate vector basis for building a vector library.

[0093] After the security detection data is vectorized, the similarity between any two security detection data can be calculated, so as to identify the security detection data with similar real content and the same meaning;

[0094] The similarity calculation methods include:

[0095] Extract the trained BERT model through Hugging Face's Transformers library; HuggingFace's Transformers library is an open source Python library that provides a large number of pre-trained models, such as BERT, GPT-2, RoBERTa, T5, etc. These models have been trained on huge data sets and can be used directly, thus saving a lot of time and computing resources; The BERT model is a deep learning model for natural language processing in Hugging Face's Transformers library, which can accurately process complex input data;

[0096] Import the deduplicated security detection data into the tokenizer for tokenization, generate single words, and add CLS tags to all single words to obtain the marked security detection data; single words are used to independently represent different texts in the security detection data, and CLS tags are used to mark each single word;

[0097] Import the labeled security detection data into the BERT model, extract the output vector corresponding to the CLS tag, and obtain A vectors;

[0098] The Euclidean distance formula is used to calculate the vector and the The distance value of a vector in multidimensional space is used to obtain the Euclidean distance;

[0099] The expression of the Euclidean distance formula is:

[0100] ;

[0101] In the formula, For the vector and the The Euclidean distance of vectors, =1,2...A, =1,2...A, For the The vector elements, For the The vector elements, is the dimension of the element;

[0102] The Euclidean distance between the vectors corresponding to any two data in the open source set, the private set, and the security set is calculated one by one, and the Euclidean distance is used as the similarity between the two security detection data to obtain P similarities.

[0103] After calculating the Euclidean distance between any two distances, the distance length between any two adjacent vectors in the multidimensional space can be represented, and the similarity between the security detection data corresponding to the two vectors can be judged by the size of the Euclidean distance. At the same time, according to the size of the similarity, the data with greater similarity can be screened out from the security detection data as valid data. At the same time, based on the valid data, a vector library is constructed, so that the vector library can be used as the basis for the subsequent security false alarm judgment of static applications;

[0104] It should be noted that when the similarity between two safety detection data is higher, it means that the element change amplitude of the vector corresponding to the two safety detection data is smaller, and the Euclidean distance is smaller and closer to 0. When the Euclidean distance is 0, it means that the two safety detection data are the same;

[0105] The construction method of the vector library includes:

[0106] Compare the P similarities with the preset similarity threshold one by one, record the similarity less than the preset similarity threshold as the effective similarity, and record the security detection data corresponding to the effective similarity as the effective data, and obtain Q valid data; the preset similarity threshold refers to the maximum value of the similarity of the security detection data when it is marked as valid data, which can provide accurate data support for the subsequent identification of valid data, ensuring that the valid data are all data with a high degree of similarity;

[0107] According to the different interpretations of the text, the Q valid data are divided into groups, and the open source valid group, the private valid group and the security valid group are obtained respectively;

[0108] Randomly extract M valid data from the open source valid group, the private valid group, and the secure valid group, and label the M valid data in turn to obtain M labeled data;

[0109] Take M valid data as Key, take the labeled data corresponding to the M valid data as Value, and import the M valid data and M labeled data into the basic library to generate a vector library.

[0110] It should be noted that the constructed vector library does not contain all the previously collected security detection data, but selects a representative part from the collected security detection data. This method can not only reduce the calculation operations of some security detection data with too close similarity and reduce the calculation burden of similarity, but also reduce the workload of subsequent data annotation.

[0111] The data screening module obtains the security detection data to be identified, calculates the real-time similarity of the security detection data to be identified, and screens out matching data from the vector library;

[0112] The security detection data to be determined refers to data that can represent the network security of the application at the current moment. If you want to obtain the security detection data to be determined, you can use the above-mentioned method of obtaining the deduplicated security detection data. First, obtain the real-time security events and real-time security detection data of the application. After obtaining the real-time security detection data, it is necessary to replace and deduplicate the replaceable parameters of the security detection data according to the above-mentioned replacement method and deduplication processing method. Thereby, useless data and useless parameters in the real-time security detection data are eliminated, and the remaining data is recorded as the security detection data to be determined. At this time, the security detection data to be determined can be used as data that may cause risks to network security at the current moment.

[0113] Real-time similarity is used to express the similarity between the security detection data to be judged and the valid data stored in the vector library, so as to express the similarity between the security detection data to be judged and the valid data already existing in the vector library, and serve as the basis for subsequent screening and matching data;

[0114] Matching data refers to valid data and the labeled data corresponding to the valid data that are screened out from the vector library based on the real-time similarity between the security detection data to be identified and the valid data, so that the matching data can be used as the training basis for the subsequent large language interpretation model, thereby meeting the basic requirements for false positive identification of security detection of applications;

[0115] Matching data includes primary data and secondary data; wherein, primary data is used to represent valid data screened out by the vector library, and secondary data is used to represent remark data of valid data screened out by the vector library, so that primary data and secondary data can be effectively combined into matching data;

[0116] The methods for screening primary and secondary data include:

[0117] Import the security detection data to be judged into the BERT model, extract the output vector corresponding to the CLS tag, and obtain C vectors to be judged;

[0118] The Euclidean distance between the C vectors to be judged and the vectors corresponding to the Q valid data is calculated one by one by using the Euclidean distance formula to obtain D real-time similarities;

[0119] Arrange the D real-time similarities in ascending order from small to large, and record the valid data corresponding to the top three real-time similarities as primary data, and record the labeled data corresponding to the primary data as secondary data.

[0120] The interpretation and discrimination module trains a large language interpretation model to interpret the labeled data based on the matching data, interprets the labeled data corresponding to the security detection data to be judged, and determines whether to issue a false alarm discrimination prompt;

[0121] The big language interpretation model refers to a model that is trained based on a large amount of matching data and can interpret the labeled data corresponding to the security detection data. It can accurately and quickly interpret the corresponding simple and easy-to-understand natural language from the complex and lengthy security detection data, thereby facilitating non-professionals to perform false positive discrimination and analysis operations on the security detection data of the application.

[0122] The training methods of the large language interpretation model include:

[0123] Convert the valid data corresponding to the master data into a corresponding set of feature vectors;

[0124] The feature vector is used as the input of the large language interpretation model, and the labeled data corresponding to the secondary data is used as the output of the large language interpretation model. The labeled data is used as the prediction target, and minimizing the sum of prediction errors of all training data is used as the training target. The large language interpretation model is trained, and the feature vector is divided into a training set and a test set. 70% of the feature vectors are used as the training set, and 30% of the feature vectors are used as the test set. The training set is used to train the large language interpretation model, and the test set is used to test the large language interpretation model. The training is stopped when the sum of prediction errors converges, and the large language interpretation model that can interpret the labeled data is obtained.

[0125] The calculation formula for the prediction error is:

[0126] ;

[0127] In the formula, is the prediction error, is the group number of the eigenvector; For the The predicted state value corresponding to the group feature vector, For the The actual state value corresponding to the group training data.

[0128] After the large language interpretation model is trained, the security detection data to be identified is input into the large language interpretation model, and the labeled data corresponding to the security detection data to be identified can be interpreted. At this time, the labeled data can simplify the complex and lengthy security detection data in natural language, accurately and reasonably represent it;

[0129] After the interpreted labeled data is obtained, it is necessary to perform false alarm discrimination analysis on the interpreted labeled data, and determine whether to issue a false alarm discrimination prompt based on the final false alarm discrimination analysis result. If it is determined that a false alarm discrimination prompt is issued, the application is not suitable for subsequent dynamic use, and the relevant security data of the application needs to be tested. If it is determined that a false alarm discrimination prompt is not issued, the application can be used dynamically in the subsequent process;

[0130] The determination method of whether to issue a false alarm identification prompt includes:

[0131] Mark the meaning, applicable scope and conditions in the interpreted annotation data respectively, and combine the meaning, applicable scope and conditions into discrimination events accordingly to obtain E discrimination events;

[0132] E standard events with the same meaning as the E discrimination events are selected from the database, and the E standard events are compared with the E discrimination events for consistency; standard events refer to events pre-stored in the database that have no network security risks and do not cause false alarms, and consist of meanings, applicable scopes, and conditions, which can provide a comparison basis for determining whether an event will cause hidden risks to network security;

[0133] When the applicable scope and conditions of the E discrimination events are consistent with the applicable scope and conditions of the E standard events, it means that there is no data in the security detection data of the application that poses a hidden danger to network security, and there is no abnormality in the related or command of the application, and it is determined that no false alarm discrimination prompt will be issued;

[0134] When the applicable scope and conditions of E discrimination events are inconsistent with the applicable scope and conditions of E standard events, it means that there is data in the security detection data of the application that poses a hidden danger to network security, and there are abnormalities in the related or commands of the application, and a false alarm discrimination prompt is issued.

[0135] It should be noted that when a false alarm identification prompt is issued, it is necessary to conduct a risk investigation on the network security of the application. The specific investigation methods include but are not limited to replacing or replacing the open source threat detection rules of the application, the private threat detection rules of the security vendor, and the common commands of various security devices. This can ensure that the application maintains network security during subsequent dynamic use, and the application will not fail due to excessive risk. It also makes it easier for non-professionals to accurately understand and analyze the relevant rules and commands in the application.

[0136] In this embodiment, by marking replaceable parameters in the security detection data, performing character replacement on the replaceable parameters, and performing deduplication processing on the replaced security detection data, it is possible to ensure that each replaced security detection data can maintain independence and uniqueness, thereby avoiding interference and influence of repeated and complex security detection data on subsequent similarity calculations, thereby improving the accuracy of static application security false alarm identification, and by vectorizing the deduplicated security detection data, calculating the similarity of the security detection data, extracting valid data, and constructing a vector library, it is possible to reduce the calculation operations of some security detection data with too close similarities, reduce the calculation burden of similarity, and also reduce the workload of subsequent data annotation, reduce the number of rules and commands in the vector library, save the time of similarity calculation, and based on matching data, train The large language interpretation model that interprets the labeled data can interpret the labeled data corresponding to the security detection data to be judged, and determine whether to issue a false alarm judgment prompt. On the one hand, it can accurately and quickly interpret the corresponding simple and easy-to-understand natural language from the complex and lengthy security detection data, thereby facilitating non-professionals to perform false alarm judgment analysis operations on the security detection data of the application, and provide accurate and effective data support for subsequent false alarm judgment of static application security detection, thereby improving the efficiency of false alarm judgment of static application security detection. On the other hand, the vector library is used to provide the structure and field information of threat detection rules and security device commands for the large language model, which can assist the large language model in understanding and generating more accurate interpretations without fine-tuning the large language model, effectively reducing the cost of using the large language model to interpret threat detection rules and security device commands.

[0137] Example 2: Please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in the first embodiment, and a static application security detection false alarm identification method based on LLM is provided, which is applied to a security detection platform and is used to implement a static application security detection false alarm identification system based on LLM, including:

[0138] S1: In static mode, historical security events of the application are obtained, and security detection data is extracted from the historical security events. The security detection data includes open source rule data, private rule data, and security command data.

[0139] S2: marking replaceable parameters in the security detection data, performing character replacement on the replaceable parameters, and performing deduplication processing on the replaced security detection data;

[0140] S3: Vectorize the deduplicated security detection data, calculate the similarity of the security detection data, extract valid data, and build a vector library;

[0141] S4: obtaining the security detection data to be identified, calculating the real-time similarity of the security detection data to be identified, and selecting matching data from the vector library, the matching data including primary data and secondary data;

[0142] S5: Based on the matching data, a large language interpretation model is trained to interpret the labeled data, the labeled data corresponding to the security detection data to be judged is interpreted, and it is determined whether to issue a false alarm judgment prompt.

[0143] Example 3: Please refer to Figure 3 As shown, this embodiment discloses an electronic device, including a processor and a memory;

[0144] Wherein, the memory stores a computer program that can be called by the processor;

[0145] The processor executes the LLM-based static application security detection false alarm identification method by calling the computer program stored in the memory.

[0146] Since the electronic device introduced in this embodiment is an electronic device used to implement the static application security detection false alarm discrimination method based on LLM in Example 2 of this application, based on the static application security detection false alarm discrimination method based on LLM introduced in the embodiment of this application, a person skilled in the art can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application is not introduced in detail here. As long as a person skilled in the art implements the electronic device used by the static application security detection false alarm discrimination method based on LLM in the embodiment of this application, it belongs to the scope of protection of this application.

[0147] Example 4: Please refer to Figure 4 As shown, this embodiment discloses a computer-readable storage medium on which a rewritable computer program is stored;

[0148] When the computer program is executed, the LLM-based static application security detection false alarm identification method is implemented.

[0149] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. The static application security detection false alarm identification system based on LLM is applied to the security detection platform, which is characterized by: include: A data extraction module is used to obtain historical security events of the application in a static mode and extract security detection data from the historical security events. The security detection data includes open source rule data, private rule data and security command data. The methods for extracting open source rule data, private rule data, and security command data include: Query all historical security events of the application in static mode through the database and mark the data sets in the historical security events; The data interpretation of each data in the data set is identified one by one through natural language processing technology, and the data interpretation is split into text interpretation and digital interpretation through word segmentation technology; Compare the text interpretation with the open source threat text in the database, and record the data containing any open source threat text in the text interpretation as open source rule data; Compare the text interpretation with the private threat text in the database, and record the data containing any private threat text in the text interpretation as private rule data; Compare the text interpretation with the commonly used command text in the database, and record the data containing any commonly used command text in the text interpretation as safe command data; The data preprocessing module is used to mark replaceable parameters in the security detection data, which include IP addresses, domain names, time and numbers, replace characters in the replaceable parameters, and perform deduplication processing on the replaced security detection data; The vector library construction module is used to vectorize the deduplicated security detection data, calculate the similarity of the security detection data, extract valid data, and construct a vector library; The data screening module is used to obtain the security detection data to be judged, calculate the real-time similarity of the security detection data to be judged, and screen out the matching data from the vector library, and the matching data includes the primary data and the secondary data; The interpretation and discrimination module is used to train a large language interpretation model for interpreting the labeled data based on the matching data, interpret the labeled data corresponding to the security detection data to be judged, and determine whether to issue a false alarm discrimination prompt.

2. According to the LLM-based static application security detection false alarm identification system of claim 1, it is characterized in that: The methods for replacing characters with replaceable parameters include: All security detection data are read in sequence through Python, and the security detection data are converted into regular expressions to obtain real-time regular expressions; Compare the real-time regular expression with the pre-stored IP address expression, domain name expression, time expression and numeric expression, and record the real-time regular expression that is consistent with the pre-stored IP address expression, domain name expression, time expression and numeric expression as the target expression; Identify the parameters in the target expression one by one and obtain the IP address, domain name, time and number; Replace the IP address, domain name, time and number with the character "*" to generate the replaced security detection data.

3. The static application security detection false alarm identification system based on LLM according to claim 2 is characterized in that: The deduplication processing methods for security detection data include: According to different types of open source rule data, private rule data and security command data, the replaced security detection data is classified into sets to obtain an open source set, a private set and a security set; Repeating and comparing the open source rule data, private rule data, and security command data in the open source set, the private set, and the security set in turn, and recording the repeated open source rule data, private rule data, and security command data as repeated data, to obtain first repeated data, second repeated data, and third repeated data; The recording times of the first duplicate data, the second duplicate data and the third duplicate data are queried one by one through the timestamps, and all the recording times are arranged in sequence according to the chronological order; The first duplicate data, the second duplicate data and the third duplicate data except the last one are deleted to obtain the deduplicated security detection data.

4. The static application security detection false alarm identification system based on LLM according to claim 3 is characterized in that: The similarity calculation methods include: Extract the trained BERT model from Hugging Face's Transformers library; Import the deduplicated security detection data into the tokenizer for tokenization, generate single-item words, and add CLS tags to all single-item words to obtain the tagged security detection data; Import the labeled security detection data into the BERT model, extract the output vector corresponding to the CLS tag, and obtain A vectors; The Euclidean distance formula is used to calculate the vector and the The distance value of a vector in multidimensional space is used to obtain the Euclidean distance; The expression of the Euclidean distance formula is: ； In the formula, For the vector and the The Euclidean distance of vectors, =1,2...A, =1,2...A, For the The vector elements, For the The vector elements, is the dimension of the element; The Euclidean distance between the vectors corresponding to any two data in the open source set, the private set, and the security set is calculated one by one, and the Euclidean distance is used as the similarity between the two security detection data to obtain P similarities.

5. The static application security detection false alarm identification system based on LLM according to claim 4 is characterized in that: The construction method of the vector library includes: Compare the P similarities with the preset similarity threshold one by one, record the similarity less than the preset similarity threshold as the effective similarity, and record the security detection data corresponding to the effective similarity as the effective data, to obtain Q effective data; According to the different interpretations of the text, the Q valid data are divided into groups, and the open source valid group, the private valid group and the security valid group are obtained respectively; Randomly extract M valid data from the open source valid group, the private valid group, and the secure valid group, and label the M valid data in turn to obtain M labeled data; Take M valid data as Key, take the labeled data corresponding to the M valid data as Value, and import the M valid data and M labeled data into the basic library to generate a vector library.

6. The static application security detection false alarm identification system based on LLM according to claim 5 is characterized in that: The methods for screening primary and secondary data include: Import the security detection data to be judged into the BERT model, extract the output vector corresponding to the CLS tag, and obtain C vectors to be judged; The Euclidean distance between the C vectors to be judged and the vectors corresponding to the Q valid data is calculated one by one by using the Euclidean distance formula to obtain D real-time similarities; Arrange the D real-time similarities in ascending order from small to large, and record the valid data corresponding to the top three real-time similarities as primary data, and record the labeled data corresponding to the primary data as secondary data.

7. The static application security detection false alarm identification system based on LLM according to claim 6 is characterized in that: The training methods of the large language interpretation model include: Convert the valid data corresponding to the master data into a corresponding set of feature vectors; The feature vector is used as the input of the large language interpretation model, and the labeled data corresponding to the secondary data is used as the output of the large language interpretation model. The labeled data is used as the prediction target, and minimizing the sum of prediction errors of all training data is used as the training target. The large language interpretation model is trained, and the feature vector is divided into a training set and a test set. The training set is used to train the large language interpretation model, and the test set is used to test the large language interpretation model. The training is stopped when the sum of prediction errors converges, and the large language interpretation model that can interpret the labeled data is obtained.

8. The static application security detection false alarm identification system based on LLM according to claim 7 is characterized in that: The determination method of whether to issue a false alarm identification prompt includes: Mark the meaning, applicable scope and conditions in the interpreted annotation data respectively, and combine the meaning, applicable scope and conditions into discrimination events accordingly to obtain E discrimination events; Select E standard events whose meanings are consistent with the E discrimination events from the database, and compare the consistency of the E standard events with the E discrimination events respectively; When the applicable scope and conditions of the E discrimination events are consistent with the applicable scope and conditions of the E standard events, it is determined that no false alarm discrimination prompt will be issued; When the applicable scope and conditions of the E discrimination events are inconsistent with the applicable scope and conditions of the E standard events, it is determined that a false alarm discrimination prompt is issued.

Images