Software supply chain threat monitoring method and device based on large model

Abstract

The invention discloses a software supply chain threat monitoring method and device based on a large model, and relates to the network security technology, and the method comprises the steps: training the large model in advance based on software supply chain security related data; based on the trained large model, constructing a large model fine tuning data set; performing instruction fine tuning on the trained large model by using the constructed large model fine tuning data set; constructing a software supply chain knowledge base based on the knowledge graph; and according to the large model subjected to instruction fine tuning and the constructed software supply chain knowledge base, detecting the obtained software supply chain data to be monitored, and based on the large model subjected to instruction fine tuning, generating a software supply chain threat monitoring report according to a set monitoring report template. According to the method, the monitoring report can be generated by using the recent original intelligence data of the software supply chain as large model input, and the function of monitoring the threat of the software supply chain is realized.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a software supply chain threat monitoring method and device based on a large model. Background Art

[0002] As the open source software supply chain system becomes larger and larger, the number of threat penetration points continues to increase, distributed in all links of the open source software supply chain. Among them, collecting various intelligence data related to the software supply chain through Internet publishing platforms such as software suppliers, vulnerability publishing platforms, and social forums, identifying potential threats and conducting monitoring and early warning can help network security practitioners quickly perceive the security risks in the software supply chain and take corresponding measures. Therefore, monitoring and early warning of software supply chain threats is a very meaningful task.

[0003] The software supply chain involves multi-faceted and multi-link knowledge, with large data volumes and extensive correlations. Traditional software supply chain threat monitoring methods mainly rely on expert experience and manual analysis, lacking systematicity and automation, and are unable to cope with complex software supply chain relationships and massive data processing requirements. Summary of the invention

[0004] The embodiment of the present application provides a software supply chain threat monitoring method and device based on a big model. By training a big model in the field of software supply chain security, a monitoring report generation task data set is constructed to fine-tune the big model. The method and device have the function of software supply chain threat monitoring report generation, and use recent software supply chain original intelligence data as the big model input to generate a monitoring report, thereby realizing the function of software supply chain threat monitoring.

[0005] The present application embodiment provides a software supply chain threat monitoring method based on a large model, including:

[0006] Pre-train large models based on software supply chain security-related data;

[0007] Based on the trained large model, build a large model fine-tuning dataset;

[0008] Use the constructed large model fine-tuning dataset to fine-tune the instructions of the trained large model;

[0009] Build a software supply chain knowledge base based on knowledge graph;

[0010] According to the fine-tuned large model and the constructed software supply chain knowledge base, the acquired software supply chain data to be monitored is tested, and,

[0011] Based on the large model fine-tuned by the instructions, a software supply chain threat monitoring report is generated according to the set monitoring report template.

[0012] Optionally, based on software supply chain security-related data in advance, training the big model includes:

[0013] Use crawlers to crawl software supply chain security-related data on the Internet;

[0014] Preprocess the crawled software supply chain security-related data to build a software supply chain text dataset, where data preprocessing includes data cleaning and formatting;

[0015] The large model is trained with all parameters based on the constructed software supply chain text dataset.

[0016] Optionally, based on the trained large model, constructing a large model fine-tuning dataset includes:

[0017] Classify the software supply chain intelligence data according to whether it is a software supply chain threat report released by an authoritative platform;

[0018] According to the software supply chain threat report, according to the time point of its release, obtain the software supply chain original intelligence data for a specified period before the time point, and construct a data record based on the software supply chain original intelligence data and the software supply chain threat report;

[0019] An entity relationship extraction model is pre-constructed, and entity relationship extraction is performed on the constructed first data record, so as to construct a large model fine-tuning data set using the obtained entity relationship triples.

[0020] Optionally, based on the trained large model, constructing a large model fine-tuning dataset further includes:

[0021] When it is determined that the data record contains multiple original intelligence data records, for any original intelligence data, a binary classification model is constructed to determine whether it is related to the software supply chain threat report, and any relevant original intelligence data is retained.

[0022] Optionally, using the constructed large model fine-tuning dataset, fine-tuning instructions on the trained large model includes:

[0023] Expand the triple data in the constructed large model fine-tuning dataset into text data;

[0024] The text data is formatted according to the set monitoring report template, and the large model is trained again based on the formatted text data using the defined monitoring report generation task.

[0025] Optionally, building a software supply chain knowledge base based on the knowledge graph includes:

[0026] Based on the original intelligence data of the software supply chain, knowledge extraction is performed to obtain entity relationship triple data;

[0027] The extracted relationship triplet data are subjected to entity alignment and knowledge fusion processing to construct a software supply chain knowledge graph. The constructed software supply chain knowledge graph includes vulnerability-related data and software component metadata.

[0028] Optionally, according to the large model fine-tuned by the instruction and the constructed software supply chain knowledge base, the acquired software supply chain data to be monitored is tested, including:

[0029] Utilize the entity relationship extraction model to extract entity relationships from the software supply chain data to be monitored;

[0030] Calculating the heat of each entity in the extracted entity relationship triples, and determining the entity with the highest heat as the monitoring object, wherein the heat is used to describe the amount of original intelligence data related to the entity; and,

[0031] Expand the extracted entity relationship triples, and search the software supply chain knowledge graph based on the text sequence obtained by the expansion to obtain related knowledge;

[0032] The large model is fine-tuned based on the monitored object, retrieved associated knowledge, and expanded text input instructions for detection.

[0033] An embodiment of the present application also proposes a software supply chain threat monitoring device based on a large model, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the software supply chain threat monitoring method based on the large model as described above are implemented.

[0034] The embodiment of the present application trains a big model in the field of software supply chain security, constructs a monitoring report generation task data set to fine-tune the big model, so that it has the ability to generate software supply chain threat monitoring reports, uses recent software supply chain raw intelligence data as the big model input to generate monitoring reports, and realizes the function of software supply chain threat monitoring.

[0035] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0037] Figure 1 The following is a basic flow diagram of a software supply chain threat monitoring method based on a large model according to an embodiment of the present application;

[0038] Figure 2 Schematic diagram of fine-tuning a data set for constructing a large model report generation task in an embodiment of the present application;

[0039] Figure 3 This is a schematic diagram of the full-parameter training of the large model in the embodiment of the present application and the fine-tuning of the large model in the field based on the monitoring report generation task;

[0040] Figure 4 Schematic diagram of building a software supply chain security knowledge base for the embodiment of the present application;

[0041] Figure 5 The present invention provides an example of a software supply chain threat monitoring framework based on a large model. DETAILED DESCRIPTION

[0042] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0043] The present application constructs a software supply chain threat monitoring framework that uses a large model to generate monitoring reports, including large model training in the field of software supply chain security, large model fine-tuning dataset construction, large model fine-tuning, software supply chain knowledge base construction, and software supply chain threat monitoring based on a large model. On the basis of this framework, by collecting recent software supply chain intelligence, by extracting entity relationship triples in the intelligence text and expanding the text, the monitoring object is clarified according to heat statistics, the key entities of the original intelligence are retrieved through the constructed software supply chain knowledge base, and the document retrieval generation RAG technology (Retrieval-Augmented Generation, RAG) is used to apply the retrieval results as additional context to the large model, combined with the software supply chain threat monitoring report template, and the monitoring report is generated using the large model, and finally the function of monitoring software supply chain threats is realized. The specific embodiment of the present application provides a software supply chain threat monitoring method based on a large model, such as Figure 1 As shown, the following steps are included:

[0044] In step S101, a large model is pre-trained based on software supply chain security related data. In some embodiments, pre-training a large model based on software supply chain security related data includes:

[0045] Use crawlers to crawl software supply chain security-related data on the Internet. For example, use crawler technology to collect software supply chain security-related data on a large scale from the Internet to ensure the diversity and comprehensiveness of the data, involving text data such as software developers, software description texts, development tools, software dependencies, vulnerability information, and software supply chain security-related reports released by major platforms.

[0046] Preprocess the crawled software supply chain security-related data to build a software supply chain text dataset, where data preprocessing includes data cleaning and formatting;

[0047] Based on the constructed software supply chain text dataset, the big model is fully trained. For example, you can choose big model training tools such as Hugging Face Transformers and Firefly to train open source big models such as LLaMA 3 or ChatGLM-2 with all parameters, enhance the big model's knowledge in the field of software supply chain security, and train a big model in the field of software supply chain security.

[0048] After obtaining a large model in the field of software supply chain security, it is necessary to construct a data set to fine-tune the model so that it can generate a software supply chain threat monitoring report. In step S102, a large model fine-tuning data set is constructed based on the trained large model.

[0049] In step S103, the constructed big model fine-tuning dataset is used to fine-tune the instructions of the trained big model. That is, based on the big model in the field of software supply chain security and the big model fine-tuning dataset, specific tasks are further defined to fine-tune the instructions of the big model.

[0050] In step S104, a software supply chain knowledge base is constructed based on the knowledge graph. For example, the software supply chain knowledge base can be constructed in the form of a knowledge graph.

[0051] In step S105, the acquired software supply chain data to be monitored is tested according to the macro model fine-tuned by the instruction and the constructed software supply chain knowledge base, and,

[0052] In step S106, based on the macro model after fine-tuning of the instructions, a software supply chain threat monitoring report is generated according to the set monitoring report template.

[0053] The embodiment of the present application trains a big model in the field of software supply chain security, constructs a monitoring report generation task data set to fine-tune the big model, so that it has the ability to generate software supply chain threat monitoring reports, uses recent software supply chain raw intelligence data as the big model input to generate monitoring reports, and realizes the function of software supply chain threat monitoring.

[0054] In some embodiments, Figure 2 As shown in the figure, based on the trained large model, building a large model fine-tuning dataset includes:

[0055] According to whether the software supply chain intelligence data is a software supply chain threat report released by an authoritative platform, the software supply chain intelligence data can be classified into two categories, namely, software supply chain reports and software supply chain original intelligence, and the time node of each data release is recorded.

[0056] According to the software supply chain threat report, according to the time node of its release, the software supply chain original intelligence data for a specified period before the time node is obtained, and a data record is constructed based on the software supply chain original intelligence data and the software supply chain threat report, for example, data record r = <software supply chain threat report, original intelligence set>.

[0057] In some embodiments, based on the trained large model, constructing a large model fine-tuning dataset further includes:

[0058] When it is determined that the "original intelligence set" in the data record r contains multiple original intelligence data records, for any original intelligence data, a binary classification model is constructed to determine whether it is relevant to the software supply chain threat report, and any relevant original intelligence data is retained; if not, it is discarded.

[0059] An entity relationship extraction model is pre-constructed, and entity relationship extraction is performed on the constructed first data record, so as to construct a large model fine-tuning data set using the obtained entity relationship triples. In some embodiments, the entity relationship extraction model can be a SpERT based on the BERT model and a Rebel entity relationship extraction model based on BART, etc., to extract entity relationship triples <entity 1, relationship, entity 2> or <entity 1, attribute, entity 2> for each piece of intelligence data in the "original intelligence set" in the data record r.

[0060] Finally, we construct a large model fine-tuning dataset R = <software supply chain threat report, monitoring object, triple 1, triple 2, …, triple n>, where n is the total number of triples, and duplicate triples have been filtered out. The "monitoring object" is obtained by formatting the software supply chain threat report through the software supply chain threat monitoring report template. Repeat the above steps for each "software supply chain threat report" to obtain the large model fine-tuning dataset R set W = {R1, R2, …, R m}, where m is the total number of software supply chain threat reports.

[0061] In some examples, the software supply chain threat monitoring report covers:

[0062] Monitoring objects: objects that threaten the security of the software supply chain in all aspects of software component development, distribution, and use, including software components, build tools, deployment environments, software vendors, and legal compliance;

[0063] Risk description: describe the risks of the monitored object, including risk category, risk cause, and risk transmission path;

[0064] Scope of impact: The scope of software components affected.

[0065] Through the above, we have obtained the big model in the field of software supply chain security and the dataset for fine-tuning the big model threat monitoring report generation task. The next step is to define specific tasks to fine-tune the instructions of the big model. The dataset W is defined to consist of data records R = <software supply chain threat report, monitoring object, triple 1, triple 2, ..., triple n>. In terms of time point, the occurrence time of "software supply chain threat report" is after the subsequent triple data. In terms of content, "software supply chain threat report" is a summary and prediction of all subsequent triple knowledge. The existing big model in the field of software supply chain security is trained on large-scale software supply chain data and can understand the knowledge related to the software supply chain field. The purpose of fine-tuning the big model in the field of software supply chain security is to enable the big model to perform text fusion, knowledge reasoning, event summary and prediction based on the input knowledge, and generate a software supply chain threat monitoring report according to the monitoring report template. Figure 3 As shown, in some embodiments, using the constructed large model fine-tuning dataset to perform instruction fine-tuning on the trained large model includes:

[0066] Expand the triple data in the constructed large model fine-tuning dataset into text data, and convert the triple data into text data that the large model can recognize. For example, directly expand the triple into "entity 1 relationship entity 2" or "entity 1 attribute relationship 2", such as the triple <component, version, 1.1> is directly expanded into "component version 1.1".

[0067] According to the set monitoring report template, the text data is formatted, and according to the formatted text data, the large model is trained again using the defined monitoring report generation task. The specific input and output of the large model fine-tuning are as follows:

[0068] Instruction: Generate a software supply chain threat monitoring report according to the software supply chain threat monitoring report template;

[0069] Input: expanded triple text sequence;

[0070] Output: Software supply chain threat monitoring report formatted according to the monitoring report template.

[0071] The embodiment of the present application defines a monitoring report generation task and uses LORA, P-Tuning and other methods to perform secondary training on a large model in the field of software supply chain security on a data set W, so that it can better adapt to the software supply chain threat monitoring report generation task.

[0072] In some embodiments, Figure 4 As shown in the figure, building a software supply chain knowledge base based on the knowledge graph includes:

[0073] Based on the original intelligence data of the software supply chain, knowledge extraction is performed to obtain entity relationship triple data;

[0074] The extracted relationship triple data is subjected to entity alignment and knowledge fusion processing to construct a software supply chain knowledge graph. The constructed software supply chain knowledge graph includes vulnerability-related data and software component metadata, where:

[0075] Vulnerability related data, such as CVE, CWE, CPE, CAPEC and other vulnerability data;

[0076] Software component metadata, such as software component name, software component dependencies, manufacturer, developer, and other software component-related data.

[0077] In some embodiments, Figure 1 As shown, according to the large model fine-tuned by the instruction and the constructed software supply chain knowledge base, the detection of the acquired software supply chain data to be monitored includes:

[0078] The entity relationship extraction model is used to extract entity relationships from the software supply chain data to be monitored. For example, crawler technology is used to collect recent software supply chain intelligence data, such as software developers, software description texts, development tools, software dependencies, vulnerability information, etc. After data preprocessing such as data cleaning and data formatting, a deep learning model is used to extract the entity relationships in the original intelligence to obtain entity relationship triplets.

[0079] The heat of each entity in the extracted entity relationship triples is counted and calculated, and the entities with the highest heat are determined as monitoring objects, wherein the heat is used to describe the amount of original intelligence data related to the entity.

[0080] The extracted entity relationship triples are expanded, and the text sequence obtained based on the expansion is searched in the software supply chain knowledge graph to obtain related knowledge, and the above two parts of text and the monitoring object are input as a large model.

[0081] The large model is fine-tuned based on the monitored object, retrieved associated knowledge, and expanded text input instructions for detection.

[0082] The present application proposes a method for constructing a large model fine-tuning dataset, the scale of which can be continuously expanded, effectively ensuring the effect of generating a large model monitoring report after fine-tuning, and provides a solution for using large-scale text data as the input of a large model, using a large number of unique triples to replace large-scale original intelligence texts to meet the large model input text length requirements, and provides a software supply chain threat monitoring solution. First, the monitoring object is determined according to the popularity of the entity in the entity relationship triplet, and a monitoring report is generated using the large model according to the monitoring report template, thereby realizing threat monitoring of specific objects in the software supply chain.

[0083] The present application also proposes a software supply chain threat monitoring device based on a large model, including a processor and a memory, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the steps of the software supply chain threat monitoring method based on a large model are implemented. In some specific examples, such as Figure 5 As shown in the figure, the computer program includes a large model training module in the field of software supply chain security, a large model fine-tuning dataset construction module in the field of monitoring report generation tasks, a large model fine-tuning module in the field of monitoring report generation tasks, a software supply chain knowledge base construction module, and a software supply chain threat monitoring system construction module based on a large model. Based on this framework, by collecting recent software supply chain intelligence, extracting entity relationship triples in the intelligence text and expanding the text, clarifying the monitoring object according to heat statistics, retrieving the key entities of the original intelligence through the constructed software supply chain knowledge base, using the document retrieval generation RAG technology (Retrieval-Augmented Generation, RAG) to apply the retrieval results as additional context to the large model, combining with the software supply chain threat monitoring report template, using the large model to generate a monitoring report, and finally realizing the function of monitoring software supply chain threats.

[0084] It should be noted that in the various embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0085] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0086] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0087] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A software supply chain threat monitoring method based on a large model, characterized in that: include: Pre-train large models based on software supply chain security-related data; Based on the trained large model, build a large model fine-tuning dataset; Use the constructed large model fine-tuning dataset to fine-tune the instructions of the trained large model; Build a software supply chain knowledge base based on knowledge graph; According to the fine-tuned large model and the constructed software supply chain knowledge base, the acquired software supply chain data to be monitored is tested, and, Based on the large model fine-tuned by the instructions, a software supply chain threat monitoring report is generated according to the set monitoring report template.

2. The software supply chain threat monitoring method based on a large model as claimed in claim 1, characterized in that: Based on the software supply chain security-related data in advance, the large model is trained to include: Use crawlers to crawl software supply chain security-related data on the Internet; Preprocess the crawled software supply chain security-related data to build a software supply chain text dataset, where data preprocessing includes data cleaning and formatting; The large model is trained with all parameters based on the constructed software supply chain text dataset.

3. The software supply chain threat monitoring method based on a large model as claimed in claim 2, characterized in that: Based on the trained large model, building a large model fine-tuning dataset includes: Classify the software supply chain intelligence data according to whether it is a software supply chain threat report released by an authoritative platform; According to the software supply chain threat report, according to the time point of its release, obtain the software supply chain original intelligence data for a specified period before the time point, and construct a data record based on the software supply chain original intelligence data and the software supply chain threat report; An entity relationship extraction model is pre-constructed, and entity relationship extraction is performed on the constructed first data record, so as to construct a large model fine-tuning data set using the obtained entity relationship triples.

4. The software supply chain threat monitoring method based on a large model as claimed in claim 3, characterized in that: Based on the trained large model, building a large model fine-tuning dataset also includes: When it is determined that the data record contains multiple original intelligence data records, for any original intelligence data, a binary classification model is constructed to determine whether it is related to the software supply chain threat report, and any relevant original intelligence data is retained.

5. The software supply chain threat monitoring method based on a large model as claimed in claim 3, characterized in that: Using the constructed large model fine-tuning dataset, the instructions for fine-tuning the trained large model include: Expand the triple data in the constructed large model fine-tuning dataset into text data; The text data is formatted according to the set monitoring report template, and the large model is trained again based on the formatted text data using the defined monitoring report generation task.

6. The software supply chain threat monitoring method based on a large model as claimed in claim 5, characterized in that: Building a software supply chain knowledge base based on the knowledge graph includes: Based on the original intelligence data of the software supply chain, knowledge extraction is performed to obtain entity relationship triple data; The extracted relationship triplet data are subjected to entity alignment and knowledge fusion processing to construct a software supply chain knowledge graph. The constructed software supply chain knowledge graph includes vulnerability-related data and software component metadata.

7. The software supply chain threat monitoring method based on a large model as claimed in claim 5, characterized in that: According to the fine-tuned large model and the constructed software supply chain knowledge base, the acquired software supply chain data to be monitored is tested including: Utilize the entity relationship extraction model to extract entity relationships from the software supply chain data to be monitored; Calculating the heat of each entity in the extracted entity relationship triples, and determining the entity with the highest heat as the monitoring object, wherein the heat is used to describe the amount of original intelligence data related to the entity; and, Expand the extracted entity relationship triples, and search the software supply chain knowledge graph based on the text sequence obtained by the expansion to obtain related knowledge; The large model is fine-tuned based on the monitored object, retrieved associated knowledge, and expanded text input instructions for detection.

8. A software supply chain threat monitoring device based on a large model, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the software supply chain threat monitoring method based on a large model are implemented as described in any one of claims 1 to 7.

Images