Data processing and training method and device, equipment and medium

Abstract

The invention discloses a data processing and training method and device, equipment and a medium. The data processing method comprises the following steps: acquiring a system call data stream; and performing identification processing on the system call data flow through a large language model, and determining a call intention of the system call data flow.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data processing and training method, device, equipment and medium. Background Art

[0002] With the rapid development of network applications, data and network security protection is of vital importance to countries, enterprises, organizations and individuals. In actual applications, attackers often attack data or networks by controlling applications to perform illegal operations. Therefore, how to accurately identify the process of applications performing illegal operations has become an urgent problem to be solved in the field of data and network security protection. Summary of the invention

[0003] Based on the above problems, the embodiments of the present application provide a data processing and training method, device, equipment and medium.

[0004] The technical solution provided by the embodiment of the present application is as follows:

[0005] The present application provides a data processing method, the method comprising:

[0006] Get system call data stream;

[0007] The system call data stream is identified and processed by a large language model to determine the calling intention of the system call data stream.

[0008] In some embodiments, the method further comprises:

[0009] If the calling intention indicates that the safety factor of the system call data flow is greater than a preset factor, the data flow whitelist is updated based on the system call data flow; wherein the updated data flow whitelist is used to screen subsequent system call data flows.

[0010] In some embodiments, the identifying and processing the system call data stream by using a large language model to determine the calling intention of the system call data stream includes:

[0011] Processing the system call data stream to obtain a traceability graph to be identified;

[0012] Based on the traceability graph to be identified, determine state migration data; wherein the state migration data at least includes node migration conditions and node migration results between nodes in the traceability graph to be identified;

[0013] The node migration condition and the node migration result in the state migration data are identified and processed by the large language model to obtain the calling intention.

[0014] In some embodiments, determining the state transition data based on the traceability graph to be identified includes:

[0015] Determine node association data between at least two nodes in the traceability graph to be identified;

[0016] The node-related data is filtered through a data flow whitelist to obtain a filtering result;

[0017] If the screening result indicates that the safety factor of the node-associated data is less than or equal to a preset factor, the state transition data is determined based on the traceability graph to be identified.

[0018] In some embodiments, the data flow whitelist includes N whitelists associated with N types of nodes; N is an integer greater than or equal to 2; the node-associated data is screened by the data flow whitelist to obtain a screening result, including:

[0019] Dividing the node association data to obtain N node sets; wherein the N node sets are associated with the N types of nodes;

[0020] Based on the nth whitelist, an nth node set in the N node sets is screened to obtain an nth screening result; wherein n is an integer greater than or equal to 1 and less than or equal to N; the nth whitelist is associated with the nth node set;

[0021] Determine the first screening result to the Nth screening result as the screening results.

[0022] In some embodiments, dividing the node-associated data to obtain N node sets includes:

[0023] Determine the node type of the node included in the node association data;

[0024] Dividing the node-associated data based on the node type to obtain a division result;

[0025] If a specified condition is met, the set in the partition result is partitioned to obtain multiple subsets; wherein the specified condition includes that the number of nodes included in any set of the partition result is greater than or equal to a first threshold, and / or the time period associated with the node is greater than or equal to a second threshold;

[0026] The multiple subsets are integrated to obtain the N node sets.

[0027] In some embodiments, obtaining the system call data stream includes:

[0028] Collect log data based on preset time windows;

[0029] Eliminating redundant data in the log data to obtain data to be extracted;

[0030] Context extraction is performed on the data to be extracted to obtain the system call data stream.

[0031] The present application also provides a training method, which includes:

[0032] Obtaining sample data associated with a sample system call data stream;

[0033] The initial large language model is trained based on the sample data to obtain a large language model; wherein the large language model is used to identify and process the system call data flow to determine the call intention of the system call data flow.

[0034] In some embodiments, the training of the initial large language model based on the sample data to obtain the large language model includes:

[0035] Eliminating redundant data in the sample data to obtain an elimination result;

[0036] Obtain open source corpus, and determine the sample traceability diagram based on the elimination results and open source corpus;

[0037] Based on the sample traceability graph, determine sample node associated data;

[0038] Training the initial large language model based on the sample node association data to obtain a large language model in an intermediate state;

[0039] The large language model in the intermediate state is trained to obtain the large language model.

[0040] In some embodiments, the training of the large language model in the intermediate state to obtain the large language model includes:

[0041] Based on the sample traceability graph, determine sample state migration data; wherein the sample state migration data includes sample migration conditions and sample migration results between nodes in the sample traceability graph;

[0042] Based on the sample migration condition and the sample migration result in the sample state migration data, the large language model in the intermediate state is trained to obtain the large language model.

[0043] The present application also provides a data processing device, the device comprising:

[0044] A first acquisition module, used for acquiring a system call data stream;

[0045] The determination module is used to identify and process the system call data stream through a large language model to determine the call intention of the system call data stream.

[0046] The present application also provides a training device, the device comprising:

[0047] A second acquisition module, used to acquire sample data associated with the sample system call data flow;

[0048] The training module is used to train the initial large language model based on sample data to obtain a large language model; wherein the large language model is used to identify and process the system call data flow to determine the call intention of the system call data flow.

[0049] An embodiment of the present application also provides an electronic device, comprising a processor and a memory; wherein a computer program is stored in the memory; when the computer program is processed by the processor, it can implement any of the data processing methods described above, or any of the training methods described above.

[0050] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor of an electronic device, it can implement any of the data processing methods described above, or any of the training methods described above.

[0051] The data processing method provided in the embodiment of the present application, after obtaining the system call data stream, processes the system call data stream through a large language model (LLM) to obtain the call intention represented by the system call data stream. In the above process, with the help of the powerful semantic understanding ability of LLM, it is possible to achieve accurate and complete recognition of system call data streams of various types and various data volumes; and with the help of the powerful semantic understanding and extraction ability of LLM, it is possible to improve the integrity, comprehensiveness and accuracy of the call intention, so that the call purpose of the system call data stream can be fully and comprehensively displayed through the call intention; at the same time, with the help of the powerful generalization ability of LLM, it is also possible to achieve flexible and targeted recognition and processing of diverse and frequently changing system call data streams, thereby meeting the detection requirements of frequently changing and diverse system call data streams; when the system call data stream corresponds to the process of an application executing an illegal operation, the data processing method provided in the embodiment of the present application can solve the technical problem of accurately identifying the process of an application executing an illegal operation in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A flowchart of a data processing method provided in an embodiment of the present application;

[0053] Figure 2 A flowchart of a training method provided in an embodiment of the present application;

[0054] Figure 3 A schematic diagram of a process for obtaining pre-training data and fine-tuning data provided in an embodiment of the present application;

[0055] Figure 4 A schematic diagram of the process of training LLM and identification provided in an embodiment of the present application;

[0056] Figure 5 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0057] Figure 6 A schematic diagram of the structure of a training device provided in an embodiment of the present application;

[0058] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0060] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0061] In the related art, the detection of system call processes is mostly achieved by analyzing the call timing characteristics. The above detection method has a high false alarm rate, and its detection results reflect the timing and frequency domain characteristics of the system call, lacking the understanding and application of the characteristics of the system call itself. Therefore, the above method cannot meet the actual detection needs of the system call process.

[0062] Based on the above problems, the embodiments of the present application provide a data processing and training method, device, equipment and medium.

[0063] The data processing method provided in the embodiment of the present application can be implemented by a processor of an electronic device, and the above-mentioned processor can be at least one of an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller (MCU), and a microprocessor.

[0064] Exemplarily, the electronic device may be a physical device or a virtual machine device.

[0065] Exemplarily, the electronic device may be a computer device.

[0066] Figure 1 A flow chart of a data processing method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method may include the following steps:

[0067] Step 101: Obtain system call data stream.

[0068] In one implementation, the system call data stream may be used to record the process of calling the interactive interface between the user state and the kernel state in the electronic device.

[0069] In one embodiment, the system call data stream may include various interactive information between the user state and the system state; wherein the interactive information may include specific behavior information, and may also include entities of behavioral operations corresponding to the various behavior information; exemplarily, the entities may include devices, processes, threads, files, interactive operations, and command lines, etc.

[0070] In one embodiment, the system call data stream may include the process of method calls, process and / or thread creation, and process and / or thread switching executed by an application in the electronic device during at least one operation; exemplarily, the above-mentioned application may include a system application and / or a user application; exemplarily, the above-mentioned application may include a container.

[0071] Step 102: identify and process the system call data flow through LLM to determine the calling intention of the system call data flow.

[0072] Among them, LLM is a natural language processing model based on deep learning, which can learn the grammar and semantics of natural language, so as to generate human-readable text. The language model in LLM includes an artificial intelligence (AI) model used to process language, text or symbol system, which is used to discover the rules contained in text or data, and automatically generate content that conforms to these rules in combination with prompts.

[0073] LLM can quickly and automatically process various natural language processing tasks, such as natural language generation, text classification, text summarization, machine translation, and speech recognition.

[0074] The LLM model can be trained on trillions of tokens and use public datasets to carry out the training process, thereby improving the semantic recognition ability of the LLM model without relying on proprietary and inaccessible datasets. Therefore, the high-performance LLM exceeds the Generative Pre-Trained Transformer (GPT-3) model (175B) on most benchmarks, while the model size is more than 10 times smaller.

[0075] In one embodiment, the call intention may include the operation purpose of the system call data flow for the target data; exemplarily, the above operation purpose may include the purpose of adding, deleting, editing, updating and / or accessing at least one kind of data; exemplarily, the target data may include at least one kind of data, such as data associated with the device identity of the electronic device, the user identity of the electronic device, etc., wherein the device identity may include the media access control (Media Access Control, MAC) address of the electronic device, the power-on password and the device name, etc., and the user identity may include the account information associated with the user of the electronic device, the password information and the timeliness information of the above two kinds of information, etc.

[0076] In an embodiment of the present application, LLM can automatically identify massive amounts of system call data streams, and track and parse the correlation between the call behaviors represented by the system call data streams, thereby deriving the call intent and explaining the execution process of the call behavior through the call intent.

[0077] In one implementation, the calling intent may be used to determine whether the system call data flow is an abnormal system call data flow, thereby implementing abnormal system call data flow detection (Detection Of Abnormal Syscall Flow).

[0078] In one implementation, the calling intent may be obtained in any of the following ways:

[0079] LLM is used to identify and process the order in which the methods and / or applications contained in the system call data stream are triggered and whether they are recursive calls, so as to obtain the call intent.

[0080] The LLM is used to identify and process the time period corresponding to the system call data stream and the order in which each method and / or application contained in the system call data stream is triggered, thereby obtaining the call intention.

[0081] The LLM is used to identify and process the attributes of the data accessed by each method and / or application in the system call data stream, thereby obtaining the call intent; wherein the above attributes may include whether the data is associated with the device identity and / or user identity, etc.

[0082] From the above, it can be seen that the data processing method provided in the embodiment of the present application, after obtaining the system call data stream, identifies and processes the system call data stream through LLM to obtain the call intention represented by the system call data stream. In the above process, with the help of the powerful semantic understanding ability of LLM, it is possible to achieve accurate and complete identification of system call data streams of various types and various data volumes; and with the help of the powerful semantic understanding and extraction ability of LLM, the integrity, comprehensiveness and accuracy of the call intention can be improved, so that the call purpose of the system call data stream can be fully and comprehensively displayed through the call intention; at the same time, with the help of the powerful generalization ability of LLM, it is also possible to achieve flexible and targeted identification and processing of diverse and frequently changing system call data streams, thereby meeting the detection requirements of frequently changing and diverse system call data streams; when the system call data stream corresponds to the process of an application executing an illegal operation, the data processing method provided in the embodiment of the present application can solve the technical problem of accurately identifying the process of an application executing an illegal operation in the related technology.

[0083] Based on the above embodiments, the data processing method provided in the embodiments of the present application may further include the following steps:

[0084] If the call intention characterizes that the safety factor of the system call data flow is greater than a preset factor, the data flow whitelist is updated based on the system call data flow.

[0085] The updated data flow whitelist is used to filter subsequent system call data flows.

[0086] Exemplarily, if the call intention characterizes that the safety factor of the system call data flow is less than or equal to a preset factor, the data flow blacklist can be updated based on the system call data flow; wherein the updated data flow blacklist is used to perform blacklist filtering on subsequent system call data flows.

[0087] In one embodiment, the safety factor may be included in the call intent, that is, the call intent may include the operation purpose of the system call data flow, and may also include the operation process performed to achieve the above operation purpose, and the safety factor of the above operation process.

[0088] In one implementation, the calling intent may be parsed and classified through the LLM, and the parsing and classification result may be determined as the safety factor of the system call data flow.

[0089] In one implementation, updating the data flow whitelist based on the system call data flow can be implemented in any of the following ways:

[0090] Add the system call data flow to the data flow whitelist.

[0091] The system call data flow overwrites the corresponding system call data flow in the data flow whitelist.

[0092] From the above, it can be seen that the data processing method provided in the embodiment of the present application, by judging the safety factor of the system call data flow represented by the calling intention, can improve the intelligent recognition level of the safety factor of the inherent characteristics of the calling behavior corresponding to the system call data flow, and enhance the summary and expression level of the calling intention and calling characteristics of the calling behavior; and, by updating the data flow whitelist based on the system call data flow, the automatic and intelligent updating of the data flow whitelist is realized; at the same time, with the help of the powerful semantic recognition ability of LLM, through the above operations, the real-time and accurate updating of the data flow whitelist can also be realized, thereby enhancing the comprehensiveness of the data flow whitelist; on the other hand, through the above operations, the probability of misscreening of subsequent system call data flows due to insufficient real-time and accuracy of the data flow whitelist can also be reduced.

[0093] Based on the foregoing embodiment, in the data processing method provided in the embodiment of the present application, the system call data stream is identified and processed by LLM to determine the calling intention of the system call data stream, which can be achieved by the following steps:

[0094] Step A1: Process the system call data stream to obtain a traceability graph to be identified.

[0095] In one implementation, the provenance graph to be identified may include a security provenance graph (SPG) corresponding to the system call data flow.

[0096] Among them, SPG can record various specific behaviors of the application when it is running. SPG includes two elements: nodes and edges connecting nodes. Among them, devices, processes, threads, files, network interaction operations and command lines are often used as nodes, and the edge indicating the flow of data represents the association information between two nodes. In SPG, the association between nodes and edges can be used to trace the specified application operation information, and the above application operation information can reveal the corresponding functions and intentions of the application operation.

[0097] In one implementation, the traceability graph to be identified may reflect at least two nodes included in the system call data flow, and the interdependence or association relationship between the at least two nodes in the time dimension.

[0098] In one implementation, the traceability graph to be identified can be obtained in the following manner:

[0099] Based on the time information contained in the system call data stream, the first node is obtained from the system call data stream, and then the node associated with the first node is obtained according to the calling relationship in the time dimension, and the association relationship between the first node and the node associated with the first node is analyzed, and then based on the first node and the node associated with the first node, and the above-mentioned association relationship, a subgraph is constructed; then in the time dimension, the above-mentioned subgraph is expanded by the above-mentioned method until the nodes in the system call data stream are traversed, at which time the subgraph can be determined as the traceability graph to be identified.

[0100] Step A2: Determine the state transition data based on the traceability graph to be identified.

[0101] The state migration data at least includes node migration conditions and node migration results between nodes in the traceability graph to be identified.

[0102] In one embodiment, the node migration conditions may include conditions for triggering node migration; exemplarily, the node migration conditions may include time conditions and / or resource conditions for triggering node migration; wherein, the resource conditions may include memory conditions and / or priority conditions, etc., and the memory conditions may include memory space greater than or equal to a preset space threshold.

[0103] In one implementation, the node migration result may include whether the mth node migrates to the jth node, and the state of the jth node after the mth node migrates to the jth node, etc., wherein m and j may be different positive integers.

[0104] In one implementation, the node migration conditions and node migration results in the state migration data may be reflected in the form of a dialogue. For example, when the node migration conditions are met, the node migration is performed and the node migration result is obtained.

[0105] In one implementation, the state transition data may correspond to at least some of the nodes in the traceability graph to be identified.

[0106] In one implementation, the state transition data may be obtained in the following manner:

[0107] For the designated node in the identified traceability graph, and the relationship between the nodes associated with the designated node, analysis and statistics are performed in the time dimension, and the results of the analysis and statistics are determined as state migration data; for example, the designated node migrates to the j-th node at the first moment, but fails to migrate to the j-th node successfully at the second moment. Accordingly, the node migration condition may include the time condition including the first moment and the second moment, and the node migration result may include successful migration to the j-th node, and unsuccessful migration to the j-th node.

[0108] Step A3: The node migration conditions and node migration results in the state migration data are identified and processed by LLM to obtain the calling intention.

[0109] In one implementation, the calling intent may be obtained in any of the following ways:

[0110] The LLM is used to identify and integrate the node migration results corresponding to the node migration executed when the node migration conditions in the state migration data are met, and then the identification and integration results are determined as the call intention.

[0111] LLM is used to identify and integrate the node migration results corresponding to the node migration when the node migration conditions in the state migration data are met, the frequency of executing the node migration, and the type of nodes associated with the node migration, and the results of the identification and integration are determined as the call intention.

[0112] From the above, it can be seen that the data processing method provided in the embodiment of the present application obtains a traceability graph to be identified by processing the system call data stream. In this way, the traceability graph to be identified can concisely and comprehensively carry and characterize the association relationship between each node in the system call data stream, and can also reduce the redundancy of the system call data stream; and the state migration data includes the node migration conditions and node migration results between the nodes in the traceability graph to be identified. In this way, the migration state and migration results between the nodes can be concisely and intuitively reflected through the state migration data; on this basis, the state migration data is identified and processed by LLM, which can reduce the amount of LLM calculation, improve the recognition processing efficiency of LLM, and improve the recognition processing accuracy of LLM.

[0113] Based on the foregoing embodiment, in the data processing method provided in the embodiment of the present application, based on the traceability graph to be identified, determining the state transition data can be achieved by the following steps:

[0114] Step B1: Determine node association data between at least two nodes in the traceability graph to be identified.

[0115] In one implementation, the node association data may include state data of migration between at least two nodes; illustratively, the association relationship data may include state data of at least one migration performed between at least two nodes.

[0116] In one implementation, the node association data may include time conditions, resource conditions, and source nodes and target nodes associated with at least one migration between at least two nodes, etc.; wherein the number of source nodes and target nodes may be the same or different.

[0117] In one implementation, the node association data may represent the association relationship between some nodes in the traceability graph to be identified.

[0118] In one implementation, the node association data may be determined in the following manner:

[0119] Obtain at least two nodes connected by an edge in the traceability graph to be identified, and obtain attribute data of the edge connecting the at least two nodes, and then determine the above attribute data as node association data; wherein the above attribute data may include the number of migrations and / or migration time between at least two nodes.

[0120] Step B2: Filter the node-related data through the data flow whitelist to obtain the filtering result.

[0121] In one implementation, the screening result may represent the threat level of the node-associated data. For example, the screening result may include whether the calling operation represented by the node-associated data is a malicious operation.

[0122] In one embodiment, the screening results can be obtained by:

[0123] In the case that there are multiple node-associated data, each node-associated data is matched and screened through the data flow whitelist to obtain multiple results, and the multiple results are determined as the screening results.

[0124] Step B3: If the screening result indicates that the safety factor of the node-related data is less than or equal to the preset factor, the state transition data is determined based on the traceability graph to be identified.

[0125] Exemplarily, if the screening result indicates that the security result of the node-associated data is greater than a preset coefficient, the operation of determining the state transition data based on the traceability graph to be identified may not be performed.

[0126] In one implementation, the safety factor of the node-associated data is less than or equal to a preset factor, which may indicate that the system call data flow corresponding to the node-associated data is not a subset of the data flow whitelist, or that the system call data flow may correspond to abnormal system call behavior.

[0127] From the above, it can be seen that the data processing method provided in the embodiment of the present application, after determining the node association data between at least two nodes in the traceability graph to be identified, filters the node association data through the data flow whitelist to obtain a screening result. In this way, through the above operation, it is possible to achieve a preliminary screening of the node association data contained in the traceability graph to be identified; and if the screening result indicates that the safety factor of the node association data is less than or equal to the preset factor, then based on the traceability data to be identified, the state transition data is determined, thereby achieving control over the operation of determining the state transition data, which can reduce the amount of calculation generated by directly determining the state transition data.

[0128] Based on the foregoing embodiments, in the data processing method provided in the embodiments of the present application, the data flow whitelist includes N whitelists associated with N types of nodes; N is an integer greater than or equal to 2.

[0129] In one implementation, the N types of nodes may include multiple types of nodes that may be included in any system call data flow; illustratively, the N types of nodes may include nodes of types such as devices, processes, threads, files, network interaction operations, and command lines.

[0130] Accordingly, the node-related data is filtered through the data flow whitelist to obtain the filtering results, which can be achieved through the following steps:

[0131] Step C1, divide the node-related data to obtain N node sets.

[0132] Among them, N node sets are associated with N types of nodes.

[0133] In one implementation, each of the N node sets may include nodes of one type.

[0134] In one implementation, the N node sets may be obtained in the following manner:

[0135] Nodes of the same call hierarchy and / or node type associated with the j-th node in the node association data are divided into a node set. For example, if the j-th node is an application node or a container node, all process nodes directly associated with the j-th node can be divided into a first node set, thread nodes directly associated with the above process nodes can be divided into a second node set, and thread nodes directly associated with the j-th node can be divided into another third node set. This cycle is repeated until all nodes in the node association data are divided.

[0136] Step C2: Screen the nth node set in the N node sets based on the nth whitelist to obtain an nth screening result.

[0137] Wherein, n is an integer greater than or equal to 1 and less than or equal to N; the nth whitelist is associated with the nth node set.

[0138] In one implementation, the nth whitelist is associated with the nth node set and may include a node type targeted by the nth whitelist, which is the same as a type of nodes included in the nth node set.

[0139] In one implementation, if the nth node set includes a node set, the nth node set may be screened based on the nth whitelist to obtain an nth screening result.

[0140] In one embodiment, if the nth node set includes multiple node sets, the multiple node sets in the nth node set can be screened in sequence based on the nth whitelist to obtain multiple sub-screening results, and the set of multiple sub-screening results can be determined as the nth screening result.

[0141] Step C3: Determine the first screening result to the Nth screening result as the screening results.

[0142] From the above, it can be seen that in the data processing method provided in the embodiment of the present application, the node-related data is divided to obtain N node sets associated with N types of nodes. In this way, through the above operations, the node-related data can be finely divided; and, based on the nth whitelist, the nth node set in the N node sets is screened to obtain the nth screening result. In this way, through the whitelist associated with N types of nodes, the N node sets associated with N node types are separately screened, so that the nth screening result can finely reflect the screening result of the node set corresponding to the nth type of node; on this basis, the first screening result to the Nth screening result are determined as the screening results. In this way, through the N screening results in the screening results, the security level of each type of node in the node-related data can be comprehensively and finely reflected.

[0143] Based on the foregoing embodiment, in the data processing method provided in the embodiment of the present application, dividing the node-related data to obtain N node sets can be implemented in the following manner:

[0144] Step D1: Determine the node type of the node included in the node association data.

[0145] In one implementation, the node type may be determined according to the node name of the node included in the node association data. For example, if the node name is a resident thread, the node type of the node may be determined to be a thread type.

[0146] Step D2: divide the node-related data based on the node type to obtain a division result.

[0147] In one embodiment, the division result may include multiple sets, each set may include multiple nodes; exemplarily, the nodes of the first type directly associated with the first node may be divided into a first set, and the nodes of the second type directly associated with any node in the first set may be divided into a second set, and the nodes of the third type directly associated with the first node may be divided into a third set, and this cycle may be repeated until all nodes in the node-associated data are divided, and all sets obtained by the division may be determined as the division result; exemplarily, the first node may be any node in the node-associated data.

[0148] Step D3: If the specified conditions are met, the set in the partition result is partitioned to obtain multiple subsets.

[0149] The specified conditions include that the number of nodes contained in any set of the division results is greater than or equal to a first threshold, and / or the node association period is greater than or equal to a second threshold.

[0150] Exemplarily, if the specified condition is not met, the node set in the partition result may not be partitioned to obtain multiple subsets.

[0151] In one implementation, the subset corresponding to the nth set in the partition result can be implemented in any of the following ways:

[0152] The nth set in the partition result is evenly divided into K subsets; wherein K is an integer greater than or equal to 2.

[0153] Based on the number of nodes corresponding to the first threshold and / or the time period length corresponding to the second threshold, the nth set in the division result is divided by the node number dimension and / or the time period length associated with the nodes to obtain K subsets.

[0154] Exemplarily, at least one subset contained in the set in the division result can be obtained by the above method.

[0155] Step D4: Integrate multiple subsets to obtain N node sets.

[0156] In one implementation, the nth node set among the N node sets may include at least one subset.

[0157] In one implementation, the N node sets can be obtained in the following manner:

[0158] Based on the association relationship between nodes in the node association data, at least two subsets included in the nth set in the division result are sequentially integrated in the time dimension, and the integration result is determined as a node set corresponding to the nth set.

[0159] From the above, it can be seen that in the data processing method provided in the embodiment of the present application, after determining the node type of the node included in the node-associated data, the node-associated data is divided based on the node type to obtain a division result, and when the division result meets the specified conditions, the set in the division result is divided to obtain multiple subsets. In this way, through the above operation, the probability of too many nodes contained in the set in the division result can be reduced; and, since the specified conditions include that the number of nodes contained in any set of the division result is greater than or equal to the first threshold, and / or the time period associated with the node is greater than or equal to the second threshold, in this way, by adjusting the first threshold and / or the second threshold, diversified and flexible control of the division of the division result can be achieved; on this basis, multiple subsets are integrated to obtain N node sets, so that the subsets in each set of the N node sets can be neatly arranged in the quantity dimension and / or the time period dimension.

[0160] Based on the foregoing embodiment, in the scheduling intention determination method provided in the embodiment of the present application, obtaining the system call data stream can be implemented by the following steps:

[0161] Step E1: Collect log data based on a preset time window.

[0162] In one implementation, the preset time window may include a preset data collection duration.

[0163] In one embodiment, the log data may include data for recording the application running process; exemplarily, the above-mentioned application may be a container; exemplarily, the above-mentioned application running process may include a system call process; exemplarily, the above-mentioned application running process may include at least one process and / or thread running process.

[0164] In one implementation, the log data may include call data of interfaces related to the application and the kernel.

[0165] Step E2: Eliminate redundant data in the log data to obtain data to be extracted.

[0166] In one implementation, the redundant data may include adjacent repeated data and garbled data in the log data.

[0167] In one implementation, a regular matching method may be used to perform regular matching on the data in the log data, thereby screening and eliminating redundant data.

[0168] Step E3: Perform context extraction on the data to be extracted to obtain a system call data stream.

[0169] In one implementation, the system call data stream may be obtained in the following manner:

[0170] Context association processing is performed on the data to be extracted, and the call object and trigger condition in the data to be extracted are obtained, and then the call object associated with the trigger condition is determined as the system call data flow.

[0171] From the above, it can be seen that in the data processing method provided in the embodiment of the present application, log data is collected based on a preset time window, thereby reducing the probability of too much log data collected in a single time; and by adjusting the preset time window, the amount of log data obtained in a single collection can be flexibly adjusted; at the same time, by removing redundant data in the log data to obtain the data to be extracted, the redundancy of the data to be extracted can be reduced, and on this basis, the efficiency of context extraction of the data to be extracted to obtain the system call data stream can be improved.

[0172] Based on the above embodiments, the present application also provides a training method. Figure 2 A flow chart of the training method provided in the embodiment of the present application is shown in FIG. Figure 2 As shown, the method may include the following steps:

[0173] Step 201: Obtain sample data associated with a sample system call data flow.

[0174] In one implementation, the sample data may include historical data associated with a calling process of at least one device, at least one application, or at least one system.

[0175] Step 202: Train the initial LLM based on the sample data to obtain the LLM.

[0176] Among them, LLM is used to identify and process the system call data flow and determine the calling intention of the system call data flow.

[0177] In one implementation, the initial LLM may have broad semantic recognition capabilities.

[0178] In one embodiment, the LLM can be obtained by:

[0179] The sample data is input into the initial LLM so that in the process of the initial LLM processing the sample data, the calling features of the system call process carried in the sample data and the calling intention represented by the calling features can be identified, captured and tracked, and the parameters of the initial LLM can be fine-tuned based on the above calling features and calling intentions, so that the LLM has the function of identifying and processing the calling intention corresponding to the system call process covered by the sample data.

[0180] From the above, it can be seen that in the training method provided in the embodiment of the present application, after obtaining sample data associated with the sample system call data flow, the LLM is obtained by training the initial LLM based on the sample data, so that the LLM can have the recognition and processing function of the call intention represented by the call process corresponding to the system call flow covered by the sample data, thereby improving the LLM's recognition accuracy of the call intention.

[0181] Based on the foregoing embodiment, in the training method provided in the embodiment of the present application, the initial LLM is trained based on the sample data to obtain the LLM, which can be achieved by the following steps:

[0182] Step F1: Eliminate redundant data in the sample data to obtain a elimination result.

[0183] Exemplarily, the redundant data in the sample data may be removed by using the method for removing redundant data in the aforementioned embodiment.

[0184] Step F2: Obtain open source corpus, and determine a sample provenance graph based on the elimination result and the open source corpus.

[0185] In one implementation, the open source corpus may include description data of migration conditions, migration process, and migration results between at least one type of nodes in a system call process.

[0186] In one embodiment, the open source prediction and elimination results may be mixed based on a preset ratio to obtain a mixed result.

[0187] In one implementation, the mixed result may be processed in the manner of determining the traceability graph to be identified in the aforementioned embodiment, thereby determining the sample traceability graph.

[0188] Step F3: Determine sample node associated data based on the sample traceability graph.

[0189] Exemplarily, the method for determining node association data in the aforementioned embodiment may be used to process the sample provenance graph to determine the sample node association data.

[0190] In one implementation, the sample node associated data may include a node migration process described in the form of text data and represented in the open source corpus and sample data.

[0191] Step F4: Train the initial LLM based on the sample node association data to obtain an intermediate state LLM.

[0192] In one implementation, the LLM in the intermediate state may have the function of tracking and identifying the node migration process and the node migration purpose in the node association data.

[0193] In one embodiment, the LLM of the intermediate state can be obtained by:

[0194] The initial LLM is used to track and identify the strength of the association relationship between nodes in the sample node association data, the migration results between nodes, and the return data after the node migration. During the above tracking and identification process, the semantic recognition parameters of the initial LLM are dynamically adjusted to obtain the LLM in the intermediate state.

[0195] In one implementation, the process of training the initial LLM based on the sample node association data to obtain the LLM in the intermediate state may be a pre-training process for the initial LLM.

[0196] Step F5: Train the LLM in the intermediate state to obtain the LLM.

[0197] In one embodiment, the LLM can be obtained by:

[0198] Adjust the ratio between the open source corpus and the removal results, and mix the open source corpus and the removal results based on the adjusted ratio to obtain an adjusted mixed result, so as to increase the relative number of the removal results in the adjusted mixed result, and train the LLM in the intermediate state based on the adjusted sample traceability graph corresponding to the adjusted mixed result to obtain the LLM; illustratively, in the above process, by adjusting the ratio between the open source corpus and the removal results, the LLM in the intermediate state can enhance its ability to track and identify the call features and call intentions in the sample data contained in the sample traceability graph.

[0199] From the above, it can be seen that in the training method provided in the embodiment of the present application, redundant data in the sample data is removed to obtain the removal result, which can reduce the redundancy of the data in the removal result; and, open source corpus is obtained, and a sample traceability graph is determined based on the removal result and the open source corpus, so that the sample traceability graph can include the call features and call intentions represented by the open source corpus and the system call process contained in the removal result; on this basis, by determining the sample node association data based on the sample traceability graph, and training the initial LLM based on the sample node association data, an intermediate state LLM is obtained, which can realize the staged training of the initial LLM, thereby providing conditions for the targeted adjustment of the model parameters during the training process; on the other hand, through the above operations, the flexibility of the initial LLM training can also be improved.

[0200] Based on the above embodiments, in the training method provided in the embodiments of the present application, the LLM in the intermediate state is trained to obtain the LLM, which can be achieved by the following steps:

[0201] Step H1: Determine sample state migration data based on the sample traceability diagram.

[0202] Among them, the sample state migration data includes the sample migration conditions and sample migration results between nodes in the sample traceability graph.

[0203] Exemplarily, the method for determining state transition data in the aforementioned embodiment can be used to determine the sample state transition data based on the sample traceability graph.

[0204] In one implementation, the sample node migration conditions and sample node migration results in the sample state migration data may be reflected in the form of a dialogue. For example, when the sample node migration conditions are met, node migration is performed to obtain the sample node migration results.

[0205] Step H2: Based on the sample migration conditions and sample migration results in the sample migration state data, the LLM in the intermediate state is trained to obtain the LLM.

[0206] In one embodiment, the LLM can be obtained by:

[0207] The sample migration conditions and sample migration results are input into the LLM in the intermediate state to guide the LLM in the intermediate state to automatically obtain the interpretation information of the system call contained in the sample migration conditions and the sample migration results according to the recognition parameters of the call features and call intents adjusted in the pre-training process, and form the corresponding call intents, and output the interpretation data corresponding to the call intents at the same time as outputting the call intents.

[0208] From the above, it can be seen that in the training method provided in the embodiment of the present application, the sample state migration data is determined based on the sample traceability diagram, and the LLM of the intermediate state is trained based on the sample migration conditions and sample migration results in the sample state migration data to obtain the LLM. In this way, the tracking and identification accuracy of the conditions and results of node switching in the system call process of the LLM of the intermediate state can be improved through the sample migration conditions and sample migration results contained in the sample traceability diagram; and through the intelligent tracking and learning of the sample migration conditions and sample migration results, the readability, comprehensiveness and accuracy of the LLM output data can be improved.

[0209] Figure 3 A schematic diagram of the process of obtaining pre-training data and fine-tuning data provided in an embodiment of the present application. Figure 3 As shown, the process may include the following steps:

[0210] Step 301: Generate a log stream.

[0211] For example, during the operation of x containers including container 1, container 2, ... container x, operations involving calling kernel-state functions, methods, or interfaces are performed. The above operations can be tracked or recorded, thereby generating a massive log stream; wherein x is an integer greater than or equal to 3.

[0212] Exemplarily, during the initial LLM training process, step 302 to step 303 may be selectively performed according to the generation speed and / or data volume of the log stream.

[0213] Step 302: Obtain log data.

[0214] Exemplarily, if the generation speed of the log stream is lower than a preset speed and / or the data volume is lower than a data volume threshold, data within a portion of a historical period may be directly intercepted from the log stream and determined as log data.

[0215] Exemplarily, after step 302 is completed, step 304 may be executed.

[0216] Step 303: Window data collection.

[0217] Exemplarily, if the log stream generation speed is greater than or equal to a preset speed and / or the data volume is greater than or equal to a data volume threshold, the log stream can be intercepted according to a preset time window and the interception result can be determined as log data.

[0218] Exemplarily, step 304 may be executed after step 303 is completed.

[0219] Step 304: Obtain system call data stream.

[0220] Exemplarily, since the log data may contain redundant data with messy format and no meaning, the redundant data in the log data can be removed to clean the log data to obtain the data to be extracted, and then context extraction is performed on the data to be extracted to obtain the system call data stream.

[0221] Step 305: Determine the traceability diagram.

[0222] Exemplarily, the traceability graph in step 305 may be the sample traceability graph in the aforementioned embodiment.

[0223] Exemplarily, the open source corpus can be obtained by the method provided in the aforementioned embodiment, and the sample provenance graph can be determined based on the elimination result and the open source corpus.

[0224] Step 306: Diversion processing.

[0225] Exemplarily, the sample node association data may be determined based on the sample traceability graph using the method provided in the aforementioned embodiment.

[0226] Exemplarily, the same method as that for obtaining the division result provided in the above embodiments may be used to perform flow separation processing on the nodes in the sample node association data according to the node types in the sample node association data.

[0227] Step 307: Frame processing.

[0228] Exemplarily, according to the method provided in the aforementioned embodiments for integrating multiple subsets to obtain N identical node sets, secondary division processing, i.e., frame processing, can be performed on the result of the diversion processing based on the graph scale and time span of the sample provenance graph to obtain a frame result containing multiple node sets; wherein, the graph scale may include the number of nodes included in the sample provenance graph, and the time span may include the length of the time period corresponding to the time points associated with the nodes included in the sample provenance graph.

[0229] Step 308: Formatting.

[0230] Exemplarily, the frame segmentation result may be formatted by adjusting uppercase characters to lowercase characters to obtain formatted sample node association data.

[0231] Step 309: Obtain pre-training data.

[0232] Exemplarily, the pre-training data may include data associated with formatted sample nodes.

[0233] Step 310: Obtain fine-tuning data.

[0234] Illustratively, fine-tuning the data may include migrating the data from a formatted sample state.

[0235] Through the above process, the pre-training data required for pre-training the initial LLM and the fine-tuning data for training the intermediate state LLM can be obtained, thereby laying a data foundation for training the initial LLM.

[0236] Figure 4 A schematic diagram of the process of training LLM and recognition provided in the embodiment of the present application, such as Figure 4 As shown, the process may include the following steps:

[0237] Step 401: Generate a log stream.

[0238] Exemplarily, the operation performed in step 401 may be the same as the operation performed in step 301 .

[0239] Step 402: Obtain log data.

[0240] Exemplarily, the operation performed in step 402 may be the same as the operation performed in step 302 .

[0241] Step 403: Window data collection.

[0242] Exemplarily, the operation performed in step 403 may be the same as the operation performed in step 303 .

[0243] Step 404: Obtain source data.

[0244] Exemplarily, for the training process of the initial LLM, the source data may be the sample data in the aforementioned embodiment.

[0245] Exemplarily, for the actual process of identifying the system call data flow, the source data may be the system call data flow in the aforementioned embodiment.

[0246] Step 405: Training process.

[0247] Exemplarily, the training process may include a process of training the initial LLM based on the pre-training data and fine-tuning data in the aforementioned embodiments.

[0248] Exemplarily, the training process may include the following steps:

[0249] Step 4051: Obtain open source corpus and determine the provenance graph.

[0250] Exemplarily, the traceability graph in step 4051 may be the sample traceability graph in the aforementioned embodiment.

[0251] Exemplarily, the method provided in the aforementioned embodiment can be used to remove redundant data in the sample data to obtain a removal result, and the open source corpus and the removal result are mixed in a preset ratio to obtain a mixed result, and a sample traceability graph corresponding to the mixed result is obtained.

[0252] Step 4052: Obtain sample node association data.

[0253] Exemplarily, the sample traceability graph may be processed by the method provided in the aforementioned embodiment to obtain sample node association data.

[0254] Step 4053: pre-training.

[0255] Exemplarily, the initial LLM may be pre-trained using sample node association data to obtain an intermediate state LLM.

[0256] Step 4054: obtain fine-tuning data.

[0257] Exemplarily, sample state transition data may be acquired from the sample traceability graph, and the sample state transition data may be determined as fine-tuning data.

[0258] Step 4055, fine-tune the instructions.

[0259] Exemplarily, the LLM of the intermediate state may be trained based on the sample state transition data, thereby completing the instruction fine-tuning process and obtaining the LLM.

[0260] Step 406: Identify the process.

[0261] Exemplarily, the identification process may correspond to the process of the data processing method provided in the aforementioned embodiment, and the process may include the following steps:

[0262] Step 4061: Obtain data to be identified.

[0263] Exemplarily, the data to be identified may include a system call data stream to be identified.

[0264] Step 4062: Whitelist detection.

[0265] Exemplarily, whitelist detection may be performed on the system call data flow based on an existing data flow whitelist.

[0266] Step 4063: Determine whether it is a whitelist subset.

[0267] Exemplarily, if the system call data stream is not a whitelist subset, steps 4064 to 4067 may be executed, and if the system call data stream is a whitelist subset, step 4068 may be executed.

[0268] Step 4064: Data formatting.

[0269] Exemplarily, uppercase characters in the system call data stream may be converted into lowercase characters, thereby completing the data formatting operation and obtaining a formatted result.

[0270] Step 4065: LLM detection.

[0271] Exemplarily, the method provided in the aforementioned embodiment can be used to identify and process the system call data stream using the LLM trained in step 405, thereby determining the calling intention of the system call data stream.

[0272] Step 4066: Determine whether it is normal.

[0273] Exemplarily, the calling intention may be analyzed to determine whether the calling operation corresponding to the system call data flow is a normal operation.

[0274] Exemplarily, if the calling operation is a normal operation, step 4068 may be executed, and if the calling operation is an abnormal operation, step 4067 may be executed.

[0275] Step 4067: Output an exception report.

[0276] Exemplarily, the abnormality report may include an abnormality alarm and a cause of the abnormality, so that the operation personnel can further verify the system data flow.

[0277] Step 4068: Whitelist update.

[0278] Exemplarily, if the system call data flow is a subset of the data flow whitelist, the whitelist may not be updated, or the system call data flow may overwrite the corresponding data flow in the data flow whitelist.

[0279] Exemplarily, if the system call data flow is not a subset of the data flow whitelist, the system call data flow may be added to the data flow whitelist.

[0280] Exemplarily, the above data flow whitelist may include nodes such as processes, files, and networks.

[0281] With the rapid development of network applications, protecting data and network security is of vital importance to enterprises and countries. In recent years, the Zero Trust Security Defense strategy has become a key research object in the field of network security. It builds a complete network security protection solution through identity control, the principle of least privilege, real-time computing access control strategy, resource controlled secure access, and multi-data source trust level assessment. It excludes all objects that are not on the trust whitelist to ensure network and data security.

[0282] In an embodiment of the present application, the unification of LLM network training and application is achieved through the above process; and, the LLM obtained through the above process training processes the system call data stream to obtain a processing result, and automatically updates the data stream whitelist by judging whether the processing result is normal. In this way, the subsequent system call data streams are processed through the updated whitelist, so that zero-trust security protection of electronic devices can be achieved.

[0283] Based on the above embodiments, the present application also provides a data processing device. Figure 5 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the device 5 may include:

[0284] A first acquisition module 501 is used to acquire a system call data stream;

[0285] The determination module 502 is used to identify and process the system call data flow through LLM to determine the calling intention of the system call data flow.

[0286] In some embodiments, the data processing device 5 may also include a first processing module, which is used to update the data flow whitelist based on the system call data flow if the safety factor of the system call data flow represented by the call intention is greater than a preset factor; wherein the updated data flow whitelist is used to screen subsequent system call data flows.

[0287] In some embodiments, the first processing module is used to process the system call data stream to obtain a traceability graph to be identified;

[0288] A determination module 502 is used to determine state migration data based on the traceability graph to be identified; wherein the state migration data at least includes node migration conditions and node migration results between nodes in the traceability graph to be identified;

[0289] The first processing module is used to identify and process the node migration conditions and node migration results in the state migration data through a large language model to obtain the calling intention.

[0290] In some embodiments, the determination module 502 is used to determine node association data between at least two nodes in the source traceability graph to be identified;

[0291] The first processing module is used to filter the node-related data through the data flow whitelist to obtain the filtering result;

[0292] The determination module 502 is used to determine the state transition data based on the traceability graph to be identified if the screening result indicates that the safety factor of the node-related data is less than or equal to a preset factor.

[0293] In some embodiments, the data flow whitelist includes N whitelists associated with N types of nodes; N is an integer greater than or equal to 2;

[0294] A first processing module is used to divide the node association data to obtain N node sets; wherein the N node sets are associated with N types of nodes;

[0295] The first processing module is further used to screen the nth node set in the N node sets based on the nth whitelist to obtain an nth screening result; wherein n is an integer greater than or equal to 1 and less than or equal to N; the nth whitelist is associated with the nth node set;

[0296] The determination module 502 is used to determine the first screening result to the Nth screening result as screening results.

[0297] In some embodiments, the determination module 502 is used to determine the node type of the node included in the node association data;

[0298] A first processing module is used to divide the node-associated data based on the node type to obtain a division result; if a specified condition is met, the set in the division result is divided to obtain multiple subsets; wherein the specified condition includes that the number of nodes included in any set of the division result is greater than or equal to a first threshold, and / or that the time period associated with the node is greater than or equal to a second threshold;

[0299] The first processing module is further used to integrate multiple subsets to obtain N node sets.

[0300] In some embodiments, the first processing module is used to collect log data based on a preset time window; remove redundant data in the log data to obtain data to be extracted; and perform context extraction on the data to be extracted to obtain a system call data stream.

[0301] Based on the above embodiments, the present application also provides a training device. Figure 6 A schematic diagram of the structure of the training device provided in the embodiment of the present application, such as Figure 6 As shown, the training device 6 may include:

[0302] The second acquisition module 601 is used to acquire sample data associated with the sample system call data flow;

[0303] The training module 602 is used to train the initial LLM based on the sample data to obtain the LLM; wherein the LLM is used to identify and process the system call data flow to determine the call intention of the system call data flow.

[0304] In some embodiments, the training device 6 may further include a second processing module for removing redundant data from the sample data to obtain a removal result; obtaining open source corpus, and determining a sample traceability graph based on the removal result and the open source corpus;

[0305] In some embodiments, the second processing module is used to determine sample node association data based on the sample traceability graph;

[0306] The training module 602 is used to train the initial large language model based on the sample node association data to obtain a large language model in an intermediate state; and train the large language model in the intermediate state to obtain a large language model.

[0307] In some embodiments, the second processing module is used to determine sample state migration data based on the sample traceability graph; wherein the sample state migration data includes sample migration conditions and sample migration results between nodes in the sample traceability graph;

[0308] The training module 602 is used to train the large language model in the intermediate state based on the sample migration conditions and sample migration results in the sample state migration data to obtain the large language model.

[0309] Based on the above embodiments, the present application also provides an electronic device, Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 7 may include a processor 701 and a memory 702; wherein the memory 702 stores a computer program; when the computer program is executed by the processor 701, it can implement the data processing method or training method provided in any of the previous embodiments.

[0310] Based on the foregoing embodiments, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor of an electronic device, it can implement a data processing method or a training method provided in any of the previous embodiments.

[0311] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0312] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0313] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0314] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0315] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0316] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0317] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0318] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0319] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0320] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0321] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0322] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A data processing method, characterized in that: The method comprises: Get system call data stream; The system call data stream is identified and processed by a large language model to determine the calling intention of the system call data stream.

2. The method according to claim 1, characterized in that The method further comprises: If the calling intention indicates that the safety factor of the system call data flow is greater than a preset factor, the data flow whitelist is updated based on the system call data flow; wherein the updated data flow whitelist is used to screen subsequent system call data flows.

3. The method according to claim 1, characterized in that The identifying and processing the system call data stream by using a large language model to determine the calling intention of the system call data stream includes: Processing the system call data stream to obtain a traceability graph to be identified; Based on the traceability graph to be identified, determine state migration data; wherein the state migration data at least includes node migration conditions and node migration results between nodes in the traceability graph to be identified; The node migration condition and the node migration result in the state migration data are identified and processed by the large language model to obtain the calling intention.

4. The method according to claim 3, characterized in that The determining of state transition data based on the traceability graph to be identified includes: Determine node association data between at least two nodes in the traceability graph to be identified; The node-related data is filtered through a data flow whitelist to obtain a filtering result; If the screening result indicates that the safety factor of the node-associated data is less than or equal to a preset factor, the state transition data is determined based on the traceability graph to be identified.

5. The method according to claim 4, characterized in that The data flow whitelist includes N whitelists associated with N types of nodes; N is an integer greater than or equal to 2; the node-associated data is screened by the data flow whitelist to obtain a screening result, including: Dividing the node association data to obtain N node sets; wherein the N node sets are associated with the N types of nodes; Based on the nth whitelist, an nth node set in the N node sets is screened to obtain an nth screening result; wherein n is an integer greater than or equal to 1 and less than or equal to N; the nth whitelist is associated with the nth node set; Determine the first screening result to the Nth screening result as the screening results.

6. A training method, characterized in that: The method comprises: Obtaining sample data associated with a sample system call data stream; The initial large language model is trained based on the sample data to obtain a large language model; wherein the large language model is used to identify and process the system call data flow to determine the call intention of the system call data flow.

7. The method according to claim 6, characterized in that The training of the initial large language model based on the sample data to obtain the large language model includes: Eliminating redundant data in the sample data to obtain an elimination result; Obtain open source corpus, and determine the sample traceability diagram based on the elimination results and open source corpus; Based on the sample traceability graph, determine sample node associated data; Training the initial large language model based on the sample node association data to obtain a large language model in an intermediate state; The large language model in the intermediate state is trained to obtain the large language model.

8. A data processing device, characterized in that: The device comprises: A first acquisition module, used for acquiring a system call data stream; The determination module is used to identify and process the system call data stream through a large language model to determine the call intention of the system call data stream.

9. A training device, characterized in that: The device comprises: A second acquisition module, used to acquire sample data associated with the sample system call data flow; The training module is used to train the initial large language model based on sample data to obtain a large language model; wherein the large language model is used to identify and process the system call data flow to determine the call intention of the system call data flow.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, it can implement the data processing method as described in any one of claims 1 to 5, or the training method as described in any one of claims 6 to 7.

Images