Security detection method and device, computer equipment and storage medium

Abstract

The invention discloses a security detection method and device, computer equipment and a storage medium. The method comprises the steps of obtaining to-be-detected data; and performing security detection on the to-be-detected data based on a pre-trained target large-scale language model to obtain a security detection result for the to-be-detected data, the target large-scale language model being obtained by training based on a corpus in the network security field. Through the semantic understanding ability of the trained target large-scale language model in the network security field, matching rules and features do not need to be constructed depending on expert experience, and the target large-scale language model obtained after training is used for security detection, so that hacker attacks with various changes can be coped with, the detection rate of hostile attacks is increased, and the security detection efficiency is improved. And the false alarm rate is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a security detection method, device, computer equipment and storage medium. Background Art

[0002] With the development of Internet technology, hackers' malicious attack methods are becoming more and more diverse. Traditional detection technology needs to rely on matching rules and features manually constructed by expert experience. These manually extracted rules and features have poor generalization ability and limited detection ability, making it difficult to cope with the diversity and variability of hacker attacks. Summary of the invention

[0003] In view of the above problems, the present application proposes a security detection method, apparatus, computer equipment and storage medium to improve the detection rate of malicious attacks by hackers and reduce the false alarm rate.

[0004] In a first aspect, an embodiment of the present application provides a security detection method, comprising: obtaining data to be detected; performing a security detection on the data to be detected based on a pre-trained target large language model to obtain a security detection result for the data to be detected, wherein the target large language model is trained based on a corpus in the field of network security.

[0005] In a second aspect, an embodiment of the present application also provides a model training method, the method comprising: obtaining a sample data set, the sample data set being a text-type data set in the field of network security; based on the sample data set, training a large language model to obtain a pre-trained target large language model, the pre-trained target large language model being used to perform security detection on the data to be detected.

[0006] In a third aspect, an embodiment of the present application provides a security detection device, comprising: an input acquisition module and a result acquisition module, wherein the input acquisition module is used to acquire data to be detected; the result acquisition module is used to perform security detection on the data to be detected based on a pre-trained target large language model to obtain a security detection result for the data to be detected, and the target large language model is trained based on a corpus in the field of network security.

[0007] In a fourth aspect, an embodiment of the present application provides a model training device, comprising: a sample acquisition module and a model training module, wherein the sample acquisition module is used to acquire a sample data set, and the sample data set is a text-type data set in the field of network security; the model training module is used to train a large language model based on the sample data set to obtain a pre-trained target large language model, and the pre-trained target large language model is used to perform security detection on the data to be detected.

[0008] In a fifth aspect, an embodiment of the present application provides a computer device, comprising: one or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the security detection method provided in the first aspect above or to execute the model training method provided in the second aspect above.

[0009] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the security detection method provided in the first aspect or the model training method provided in the second aspect.

[0010] The solution provided by the present application obtains the data to be detected; performs security detection on the data to be detected based on a pre-trained target large language model to obtain security detection results for the data to be detected, wherein the target large language model is trained based on a corpus in the field of network security. Through the semantic understanding ability of the trained target large language model in the field of network security, it is no longer necessary to rely on expert experience to construct matching rules and features, but only to use the trained target large language model for security detection, so as to cope with various hacker attacks, improve the detection rate of malicious attacks, and reduce the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0012] Figure 1 A flow chart of a safety detection method provided by an embodiment of the present application is shown.

[0013] Figure 2 A flow chart of a safety detection method provided in another embodiment of the present application is shown.

[0014] Figure 3 A specific flow chart of step S220 in another embodiment of the present application is shown.

[0015] Figure 4 A flow chart of a model training method provided in yet another embodiment of the present application is shown.

[0016] Figure 5 A specific flow chart of step S310 in another embodiment of the present application is shown.

[0017] Figure 6 A specific flow chart of step S311 in another embodiment of the present application is shown.

[0018] Figure 7 A specific flow chart of step S312 in another embodiment of the present application is shown.

[0019] Figure 8 A specific flow chart of step S320 in another embodiment of the present application is shown.

[0020] Fig. 9 A specific flow chart of step S322 in another embodiment of the present application is shown.

[0021] Fig.10 A structural block diagram of a safety detection device provided in an embodiment of the present application is shown.

[0022] Fig.11 A structural block diagram of a model training device provided in an embodiment of the present application is shown.

[0023] Fig.12 A structural block diagram of a computer device provided in an embodiment of the present application is shown.

[0024] Fig.13 A structural block diagram of a computer-readable storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0026] With the rapid development of Internet technology, hackers use their technology and knowledge to illegally and maliciously invade computer systems, networks or applications in order to obtain illegal profits, disrupt the normal operation of the system, infringe on the privacy of others or conduct other illegal activities, thereby obtaining, destroying, tampering with or stealing sensitive information, data or resources. The methods used by these hackers to carry out malicious attacks are changing with each passing day, emerging in an endless stream and being pervasive, posing a serious threat to network security.

[0027] Generally speaking, the detection technology for malicious hacker attacks mainly relies on matching rules and features manually constructed based on expert experience, and performs security detection through matching rules and feature training models. However, due to the poor generalization ability of manually extracted rule features, the detection ability of the model is limited, and the trained model still lacks the ability to interpret malicious attacks. The application scenarios are limited, and it is difficult to cope with the diversity and variability of hacker attacks.

[0028] Therefore, the inventors have proposed the security detection method, device, computer equipment and storage medium provided in the embodiments of the present application. Through the semantic understanding ability of the trained target large language model in the field of network security, it is no longer necessary to rely on expert experience to build matching rules and features, but only use the trained target large language model for security detection, which can cope with various hacker attacks, improve the detection rate of malicious attacks, and reduce the false alarm rate. Among them, the specific security detection method is described in detail in the subsequent embodiments.

[0029] The security detection method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings.

[0030] See also Figure 1 , Figure 1 A schematic diagram of a safety detection method provided by an embodiment of the present application is shown below. Figure 1 The process shown is described in detail, and the safety detection method may specifically include the following steps:

[0031] Step S110: Acquire the data to be detected.

[0032] In an embodiment of the present application, the computer device can obtain the data to be detected from the local storage of the device or from the network connection, so that the pre-trained target large language model can perform corresponding security detection on the data to be detected. Among them, the security of the data to be detected cannot be determined, that is, the computer device can use all data with uncertain security stored locally or obtained from the network connection as the data to be detected, and the types of these data to be detected can be file types, execution scripts, command lines and / or request data packets, etc.

[0033] In some embodiments, after obtaining the data to be detected, the computer device may process the data to be detected, for example, by reading the data to be detected through a pre-written script program to obtain text content data corresponding to the data to be detected, and then obtain input prompt information that can be input into the target large language model based on the text content data. The target large language model can perform security detection on the data to be detected based on the input prompt information obtained by input.

[0034] In other implementations, the computer device may also directly input the data to be detected into the target large language model, wherein the data to be detected may be file-type data, or program script, request, command, and other types of data.

[0035] Step S120: Perform security detection on the data to be detected based on a pre-trained target large language model to obtain a security detection result for the data to be detected, wherein the target large language model is trained based on a corpus in the field of network security.

[0036] In the embodiment of the present application, after the computer device obtains the data to be detected, it can perform security detection on the data to be detected based on the pre-trained target large language model, and obtain the security detection results output by the model. Among them, the target large language model is trained based on the corpus in the field of network security, that is, the target large language model has the semantic understanding ability in the field of network security, can perform security detection on the data to be detected according to the professional knowledge in the field of network security, and while outputting the security detection results, make the output data more in line with the language habits in the field of network security.

[0037] Among them, a large language model refers to a deep learning model trained with large-scale text corpus, which can generate natural language text or understand the meaning of language text, and perform a wide range of tasks including text summarization, question and answer, dialogue, sentiment analysis, etc. At the same time, a large language model is also a large model, and a large model refers to a machine learning model with a large number of parameters and a complex structure. Large models can be applied to process large-scale data and complex problems. Traditional machine learning models, such as logistic regression, decision trees, and naive Bayes, are small in scale and can only process small amounts of data. Deep learning models can contain millions of parameters and process massive amounts of data. Ultra-large-scale deep learning models can even reach tens of billions of parameters and require supercomputers for training. Therefore, the pre-trained target large language model has the advantages of strong ability to process large-scale data, strong ability to handle complex problems, and higher accuracy and performance.

[0038] Among them, the target large language model used in the embodiment of the present application can be a generative pre-trained (Generative Pre-trained Transformer, GPT) model, which is a natural language processing (Natural Language Processing, NLP) model based on deep learning. As a pre-training model, the GPT model can automatically capture the laws and general knowledge of language by learning from large-scale data sets, thereby showing higher accuracy and fluency when generating text. However, at this time, the GPT model does not yet have knowledge in professional fields such as network security, so the GPT model can be further trained based on the corpus in the field of network security, so that the trained target large language model has the semantic understanding ability in the field of network security.

[0039] The security detection method provided in the embodiment of the present application obtains the data to be detected; performs security detection on the data to be detected based on a pre-trained target large language model to obtain security detection results for the data to be detected, wherein the target large language model is obtained through training based on a corpus in the field of network security. Through the semantic understanding ability of the trained target large language model in the field of network security, it is no longer necessary to rely on expert experience to construct matching rules and features, but only to use the trained target large language model for security detection, so as to cope with various hacker attacks, improve the detection rate of malicious attacks, and reduce the false alarm rate.

[0040] See also Figure 2 , Figure 2 A schematic diagram of a safety detection method provided by another embodiment of the present application is shown below. Figure 2 The process shown is described in detail, and the process of the safety detection method may specifically include the following steps:

[0041] Step S210: Acquire the data to be detected.

[0042] In the embodiment of the present application, step S210 can refer to the contents of other embodiments and will not be described in detail here.

[0043] Step S220: obtaining input prompt information corresponding to the data to be detected, wherein the input prompt information is used to instruct the target large language model to perform security detection on the data to be detected.

[0044] In an embodiment of the present application, the input prompt information corresponding to the data to be detected determined by the computer device may include the text content data of the data to be detected and the keywords corresponding to the detection operation performed by the target large language model on the data to be detected. For example, the target large language model may be required to perform detection operations such as "judging black and white" or "interpreting the execution process". Among them, the input prompt information may also be prompt information (prompt) for inputting a large language model. Based on the input prompt information, the target large language model can obtain the text content data of the data to be detected and the keywords of the detection operation performed on the data to be detected. After performing a security detection operation on the data to be detected, the result of the security detection is used as the output data of the target large language model.

[0045] In some embodiments, the computer device can determine corresponding input prompt information according to different types of data to be detected, that is, according to different types of data to be detected, instruct the target large language model to perform different security detection operations on the data to be detected. For example, the target large language model can perform black and white judgment operations on some simple data to be detected with low risk, and perform black and white judgment and interpretation and execution process operations on other data to be detected with higher risk level or more complex data to be detected.

[0046] In other implementations, the computer device may also determine the security detection operations to be performed on the data to be detected input into the target large language model according to the training process of the target large language model. That is to say, during the process of training the target large language model, the technicians may train the model according to fixed detection operations. For the same target large language model that has completed the training, the same security detection operations may be performed on different data to be detected.

[0047] In some embodiments, Figure 3 As shown, the computer device can obtain the input prompt information corresponding to the data to be detected in the following manner:

[0048] Step S221: Acquire text content data corresponding to the data to be detected.

[0049] In an embodiment of the present application, the input prompt information is used to instruct the target large language model to perform a security check on the data to be detected, and since the target large language model is a natural language processing model, the data input to it should also be text-type data. Therefore, the input prompt information input to the target large language model must include the text content data of the data to be detected. In other words, if the computer device wants to determine the input prompt information, it must first determine the data to be detected and obtain the text content data corresponding to the data to be detected. Specifically, the computer device loads the file to be detected and reads the file content to obtain the text content data corresponding to the data to be detected.

[0050] Step S222: Acquire keywords for prompting the target large language model to perform security detection.

[0051] In the embodiment of the present application, the input prompt information not only needs to include the text content data of the data to be detected that the target large language model needs to perform security detection on, but also needs to include the keywords corresponding to the specific security detection operation that the target large language model needs to perform on the data to be detected, so that the target large language model can determine what security detection operation to perform on the data to be detected based on the input prompt information. Therefore, the computer device also needs to obtain the keywords for security detection in order to generate input prompt information that instructs the target large language model to perform security detection.

[0052] In some embodiments, the computer device may determine the key words for security detection based on the data to be detected. For example, for some simple data to be detected, the computer device may determine that the key words corresponding to security detection are "determine black and white", but for some complex data to be detected, the target large language model may not be able to accurately determine black and white, so the computer device may determine that the key words corresponding to security detection are "determine confidence", so that the target large language model can output the probability that the data to be detected is safe data or dangerous data.

[0053] In other embodiments, the keywords for the security detection performed by the target large language model may be pre-set, and after the computer device obtains the text content data corresponding to the data to be detected, it may directly generate input prompt information based on the pre-set keywords and text content data. For example, the keywords for the security detection performed by the target large language model include "judgment of black and white" and "interpretation of the execution process", then for all the data to be detected, the input prompt information of the target large language model will include these two keywords, and the target large language model will also perform security detection of "judgment of black and white" and "interpretation of the execution process" on all input data to be detected.

[0054] Step S223: Generate the input prompt information based on the text content data and the keywords.

[0055] In an embodiment of the present application, after determining the text content data corresponding to the data to be detected and the keywords for security detection to be performed by the target large language model, the computer device can generate input prompt information for inputting into the target large language model based on the text content data and the keywords.

[0056] For example, the computing device obtains a link http:\1stopmoney.com\paypal-login-secure\websc.php from an email received by the user. The security of the link is unknown, so the computer device needs to perform a security check on the link through the target large language model before the user clicks the link. Among them, the keywords for security detection determined by the computer device are "judge black and white" and "interpretation", so the input prompt information generated by the computer device can be "interpret 'http:\1stopmoney.com\paypal-login-secure\websc.php' and judge black and white".

[0057] Step S230: input the input prompt information into the pre-trained target large language model to obtain a security detection result for the data to be detected.

[0058] In some embodiments, the security detection result may include a security judgment result and a security interpretation result for the data to be detected. It is understandable that the input prompt information input into the target large language model includes a plurality of different security detection keywords, and for each keyword, the result obtained by the target large language model performing security detection may be different. For example, the result obtained by the target large language model performing security detection on the "black and white judgment" keyword may be a security judgment result, that is, there are only two output results, black and white; the result obtained by the security detection on the "interpretation" keyword may be a security interpretation result, that is, the process and result of the execution of the data to be detected predicted by the target large language model.

[0059] In some embodiments, if the input prompt information of the target large language model is "Interpret 'http:\1stopmoney.com\paypal-login-secure\websc.php' and judge whether it is black or white", then the output of the model can be "It will pop up a web page to the user, requiring the user to enter their PayPay login information. This web page looks very much like the official website of PayPal, but it is actually a phishing website whose purpose is to defraud the user's login information; so I think this is a malicious URL", wherein the security judgment result is "So I think this is a malicious URL", and the security interpretation result is "It will pop up a web page to the user, requiring the user to enter their PayPay login information. This web page looks very much like the official website of PayPal, but it is actually a phishing website whose purpose is to defraud the user's login information".

[0060] In some embodiments, after the pre-trained target large language model completes the security detection operation on the input data to be detected, the computer device can obtain the security detection result based on the model output and output the security detection result. Among them, the security detection result can characterize the security of the data to be detected, that is, determine whether the data to be detected is safe data or dangerous data; it can also include confidence data, that is, determine the security level of the data to be detected, and the computer device can judge the security level or danger level of the data to be detected based on the confidence data, or judge the probability that the data to be detected is safe data or dangerous data; the security detection result can also include the predicted execution process of the data to be detected, that is, the target large language model can predict the execution process and execution effect of the data to be detected based on empirical knowledge.

[0061] In some embodiments, after obtaining the security detection results, the computer device can directly display the text-type security detection results to the user, and the user can independently determine how to handle the data to be detected. Among them, the user can understand whether the data to be detected is dangerous data or safe data based on the displayed information, and predict the execution process, and perform different operations on the data to be detected according to different displayed information. For example, the user can ignore the safe data and delete the dangerous data. For example, the user can also add the file to which the dangerous data belongs to the blacklist list to prohibit the computer device from accessing the data.

[0062] In some embodiments, after obtaining the security detection result, the computer device can also perform preliminary processing on the data to be detected directly based on the text-type security detection result. For example, if the security detection result characterizes that the data to be detected is dangerous data, the computer device can directly delete the file to which the data to be detected belongs, or add the file to the blacklist. For another example, if the security detection result includes confidence data of the data to be detected, but the computer device cannot determine whether the data to be detected is safe or dangerous based on the confidence data, then the computer device can display and output the data to be detected to the user, and the user determines the black and white of the data to be detected, or the computer device can be based on the prediction execution process included in the security detection result, combined with the confidence data, to comprehensively determine the black and white of the data to be detected.

[0063] The security detection method provided in the embodiment of the present application generates input prompt information based on the text content data and keywords by acquiring the text content data corresponding to the data to be detected and the keywords used to prompt the target large language model to perform security detection; the input prompt information is input into the pre-trained target large language model to obtain the security detection result for the data to be detected. Thus, corresponding input prompt information can be generated through different data to be detected and different keywords, so that the target large language model can perform corresponding security detection operations for different data to be detected, thereby coping with various hacker attacks, improving the detection rate of malicious attacks, and reducing the false alarm rate.

[0064] See also Figure 4 , Figure 4 A flow chart of a model training method provided by another embodiment of the present application is shown below. Figure 4 The process shown is described in detail. The model training process can specifically include the following steps:

[0065] Step S310: Acquire a sample data set, where the sample data set is a text-type data set in the field of network security.

[0066] With respect to the target large language model in other embodiments, the embodiments of the present application provide a training method for the target large language model. It is worth noting that the training of the target large language model can be performed in advance based on the acquired sample data set. Subsequently, each time the security of the data to be detected needs to be determined, the trained target large language model can be used, without the need to train the target large language model every time.

[0067] In an embodiment of the present application, a sample data set acquired by a computer device is used to train a large language model so that the trained target large language model has language understanding capabilities in the field of network security. Therefore, the data set used to train the model should also be data in the field of network security. At the same time, since the trained model is a language model, the collected sample data set is also a text-type data set.

[0068] In some implementations, the sample data set acquired by the computer device may include a first text data set and a second text data set, wherein the first text data set is an unlabeled data set in the field of network security, and the second text data set is an artificially constructed labeled data set. Figure 5 As shown, the computer device can obtain the sample data set through the following steps:

[0069] Step S311: Acquire a first text dataset, where the first text dataset is an unlabeled dataset in the field of network security.

[0070] In an embodiment of the present application, the target large language model can be trained on the basis of an open source GPT model. Among them, the GPT model is a model that performs unsupervised learning on a large-scale corpus and trains the generator through the prediction of contextual information, so that it has a certain language understanding ability and generation ability, but this model's semantic understanding ability in vertical fields is not perfect enough. Therefore, the computer device needs to collect an unlabeled data set in the field of network security as the first text data set to train the initial GPT large model so that the trained model has semantic understanding ability in the field of network security.

[0071] In some embodiments, Figure 6 As shown, obtaining the first text data set in step S311 can be achieved by the following steps:

[0072] Step S3111: Acquire first text data, where the first text data includes text content data of each sub-field in the network security field.

[0073] Step S3112: Filter and deduplicate the first text data to obtain the first text data set.

[0074] In an embodiment of the present application, a computer device can collect text content data of various sub-fields in the field of network security in network forums, professional websites, etc. through a preset script program, including but not limited to data such as uniform resource locators, files, command lines, process sequences, http traffic, script files, etc. These text content data are unprocessed, and may include some repeated low-quality data. Therefore, after obtaining the first text data, the computer device also needs to filter and de-duplicate these data. Wherein filtering refers to filtering out low-quality data and data with too long content in the first text data with rules. For example, filtering rules can be rules such as too many punctuation marks, meaningless words, web page tags, pure digital composition, and sentence length less than 5 in the same sentence. Wherein de-duplicate processing can be to use minhash algorithm and jaccard similarity algorithm to remove data with higher content similarity in the first sample data. After the above-mentioned filtering and de-duplicate processing, the computer device can obtain the first text data set.

[0075] Step S312: Acquire a second text dataset, where the second text dataset is an artificially constructed annotated dataset.

[0076] In the embodiment of the present application, the first text data set is an unlabeled data set in the field of network security. By training the GPT model with the first text data set, only a model with language understanding ability in the field of network security can be obtained, but the target large language model capable of security detection should be able to accurately output the detection results on the basis of having the ability to understand the data to be detected. In other words, the ability of this model to output answers to different data to be detected is not perfect enough. Therefore, the computer equipment also needs to obtain an artificially constructed labeled data set to further train the model to make the output data of the model more accurate and professional.

[0077] In some embodiments, Figure 7 As shown, obtaining the second text data set in step S312 can be achieved by the following steps:

[0078] Step S3121: Obtain multiple items of the second text data, and answer data annotated for the second text data, wherein the second text data is text data that describes a question for the target data, the answer data is text data that performs a response analysis on the second text data, and the target data is text content data corresponding to data with known security and known execution process.

[0079] In the embodiment of the present application, the second text data is artificially constructed text data that describes the problem for known data, such as "Interpret 'http:\1stopmoney.com\paypal-login-secure\websc.php' and determine whether it is black or white", where "http:\1stopmoney.com\paypal-login-secure\websc.php" is known data, that is, the technician who constructs the second text data is aware of the security and execution process of the link. At the same time, due to the known nature of the target data, the technician can also construct answer data annotated for the second text data based on the known security and execution process. For example, the answer data corresponding to the above second text data can be constructed as "It will pop up a web page to the user, asking the user to enter their PayPay login information. This web page looks very much like the official website of PayPal, but it is actually a phishing website whose purpose is to defraud the user's login information; so I think this is a malicious URL."

[0080] Step S3122: construct the second text data set based on multiple pieces of the second text data and answer data annotated for the second text data.

[0081] In an embodiment of the present application, a technician can obtain a second text data set based on the second text data constructed for target data of known security and known execution process, as well as answer data annotated for the second text data, for further training the model with semantic understanding capabilities in the field of network security, so that the output data of the trained model is more accurate and professional.

[0082] Step S320: Based on the sample data set, a large language model is trained to obtain a pre-trained target large language model, and the pre-trained target large language model is used to perform security detection on the data to be detected.

[0083] In an embodiment of the present application, after obtaining the first text data set and the second text data set, the computer device can train a large language model based on the sample data set so that the target large language model obtained after training can accurately perform security detection on the data to be detected.

[0084] Specifically, if Figure 8 As shown, a computer can train a large language model based on a sample data set according to the following steps:

[0085] Step S321: performing unsupervised pre-training on the large language model based on the first text data set to obtain a trained large language model as a universal security model.

[0086] In an embodiment of the present application, after the computer device obtains the first text data set and the second text data set through the above steps, it can first perform unsupervised pre-training on a large language model through the first text data set, so that the general security model obtained after the training has semantic understanding capabilities in the field of network security.

[0087] In some implementations, the large language model used in the embodiments of the present application may be the llama2-13B model published by Meta, but this model obviously lacks knowledge and experience in vertical fields. Therefore, the computer device may enable the model to have semantic understanding capabilities in the field of network security through incremental training based on the first text data set. Specifically, incremental training may be performed in a full-scale fine-tuning manner.

[0088] In some implementations, before training the large language model based on the first text data set, the computer device may also configure a training environment for the large language model. Specifically, the computer device first downloads the llama2-13B large model published by Meta, including the model's weight file, tokenizer configuration file, special-tokens-map file, tokenizer file, etc.; thereafter, the corresponding distributed training environment is deployed. The model training process needs to be performed on multiple A100s and accelerated using deepspeed.

[0089] Step S322: Perform supervised training on the universal security model based on the second text data set to obtain the trained universal security model as the pre-trained target large language model.

[0090] In an embodiment of the present application, after obtaining the general security model, the computer device can perform further supervised training on the general security model based on a pre-constructed second text data set with annotations, so that the target large language model obtained after the training is completed can provide output answer data that is accurate, professional and in line with actual language habits for the data to be detected.

[0091] In some embodiments, Fig. 9 As shown, the training process for the general security model in step S322 may include the following steps:

[0092] Step S3221: input each second text data item in the second text data set into the universal security model in sequence, and obtain predicted output data corresponding to each second text data item output by the universal security model.

[0093] Step S3222: Determine a first loss value based on the answer data annotated by each item of the second text data and the predicted output data corresponding to each item of the second text data.

[0094] In an embodiment of the present application, each second text data item in the second text data set corresponds to different annotated answer data, wherein the answer data is not used to be input into the universal security model, but is used to determine the first loss value of the model and indicate the adjustment direction of the model for the predicted output data generated by the universal security model based on the second text data. The computer device can sequentially input the second text data in the second text data set into the universal security model to obtain the predicted output data generated by the universal security model for each second text data item. Obviously, in the early stage of model training, there must be a large difference between the predicted output data corresponding to the same second text data and the annotated answer data, and the computer device can determine the first loss value of the universal security model based on the difference between the two.

[0095] Step S3223: iteratively train the universal security model based on the first loss value until the universal security model meets a first preset condition, and obtain the trained universal security model as the target large language model.

[0096] In the embodiment of the present application, after obtaining the first loss value of the general security model, the computer device can fine-tune the data of the general security model to further stimulate the detection and interpretation capabilities of the model in the field of network security. Specifically, the computer device can iteratively train the general security model based on the first loss value, and continuously adjust the parameters of the model until the general security model meets the first preset condition, that is, the iteration termination condition is met, and the training is completed to obtain the target large language model.

[0097] In the embodiment of the present application, by obtaining an unlabeled first text data set in the field of network security and an artificially constructed labeled second text data set; based on the first text data set, the large model is unsupervisedly pre-trained to obtain the trained large model as a general security model, and based on the second text data set, the general security model is supervised and trained to obtain the trained general security model as the target large language model. Thus, the large language model is trained in turn by the first text data set and the second text data set, so that the trained target large language model not only has the semantic understanding ability in the field of network security, but also can output accurate, professional and actual semantic interpretation and judgment data for the data to be detected, thereby improving the accuracy and detection efficiency of malicious attack detection.

[0098] See also Fig.10, which shows a structural block diagram of a security detection device 200 provided in an embodiment of the present application, and the security detection device 200 includes: an input acquisition module 210 and a result acquisition module 220. The input acquisition module 210 is used to obtain the data to be detected; the result acquisition module 220 is used to perform security detection on the data to be detected based on a pre-trained target large language model to obtain a security detection result for the data to be detected, and the target large language model is obtained by training based on a corpus in the field of network security.

[0099] As a possible implementation, the result acquisition module 220 may include: a prompt acquisition unit and a result acquisition unit, wherein the prompt acquisition unit is used to obtain input prompt information corresponding to the data to be detected, and the input prompt information is used to instruct the target large language model to perform security detection on the data to be detected; the result acquisition unit is used to input the input prompt information into a pre-trained target large language model to obtain a security detection result for the data to be detected.

[0100] As a possible implementation, the prompt acquisition unit is also used to obtain text content data corresponding to the data to be detected; obtain keywords used to prompt the target large language model to perform security detection; and generate input prompt information based on the text content data and keywords.

[0101] As a possible implementation, the security detection result includes a security interpretation result for the data to be detected.

[0102] See also Fig.11 , which shows a structural block diagram of a model training device 300 provided in an embodiment of the present application, the model training device 300 includes: a sample acquisition module 310 and a model training module 320, wherein the sample acquisition module is used to acquire a sample data set, and the sample data set is a text-type data set in the field of network security; the model training module is used to train a large language model based on the sample data set to obtain a pre-trained target large language model, and the pre-trained target large language model is used to perform security detection on the data to be detected.

[0103] As a possible implementation, the sample data set includes a first text data set and a second text data set, the first text data set is an unlabeled data set in the field of network security, and the second text data set is an artificially constructed labeled data set. The model training module is also used to perform unsupervised pre-training on a large language model based on the first text data set, and obtain the trained large language model as a general security model; and perform supervised training on the general security model based on the second text data set, and obtain the trained general security model as a pre-trained target large language model.

[0104] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0105] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.

[0106] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0107] In summary, the solution provided by the present application obtains the data to be detected; performs security detection on the data to be detected based on a pre-trained target large language model to obtain security detection results for the data to be detected, wherein the target large language model is obtained through training based on a corpus in the field of network security. Through the semantic understanding ability of the trained target large language model in the field of network security, it is no longer necessary to rely on expert experience to construct matching rules and features, but only use the trained target large language model for security detection, so as to cope with various hacker attacks, improve the detection rate of malicious attacks, and reduce the false alarm rate.

[0108] Please refer to Fig.12 , which shows a structural block diagram of a computer device 400 provided in an embodiment of the present application. The computer device 400 may be a physical server, a cloud server, etc. The computer device 300 in the present application may include one or more of the following components: a processor 410, a memory 420, and one or more application programs, wherein the one or more application programs may be stored in the memory 420 and configured to be executed by one or more processors 410, and the one or more programs are configured to execute the method described in the aforementioned method embodiment.

[0109] The processor 410 may include one or more processing cores. The processor 410 uses various interfaces and lines to connect various parts of the entire computer device, and executes various functions of the computer device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 420, and calling data stored in the memory 420. Optionally, the processor 410 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 410 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 410, but may be implemented separately through a communication chip.

[0110] The memory 420 may include a random access memory (RAM) or a read-only memory (ROM). The memory 420 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 420 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the computer device during use.

[0111] Please refer to Fig.13 , which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable medium 800 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0112] The computer readable storage medium 800 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer readable storage medium 800 includes a non-transitory computer-readable storage medium. The computer readable storage medium 800 has storage space for program code 810 that performs any method step in the above method. These program codes can be read from or written to one or more computer program products. The program code 810 can be compressed, for example, in an appropriate form.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A safety detection method, characterized in that: The method comprises: Obtain the data to be tested; The data to be detected is subjected to security detection based on a pre-trained target large-scale language model to obtain a security detection result for the data to be detected, wherein the target large-scale language model is obtained by training based on a corpus in the field of network security.

2. The method according to claim 1, characterized in that: The performing security detection on the data to be detected based on the pre-trained target large language model to obtain a security detection result for the data to be detected includes: Acquire input prompt information corresponding to the data to be detected, where the input prompt information is used to instruct the target large language model to perform security detection on the data to be detected; The input prompt information is input into the pre-trained target large language model to obtain a security detection result for the data to be detected.

3. The method according to claim 2, characterized in that The obtaining of input prompt information corresponding to the data to be detected includes: Acquire text content data corresponding to the data to be detected; Obtaining keywords for prompting the target large language model to perform security detection; The input prompt information is generated based on the text content data and the keywords.

4. The method according to any one of claims 1 to 3, characterized in that: The security detection result includes a security interpretation result for the data to be detected.

5. A model training method, characterized in that: The method comprises: Acquire a sample data set, where the sample data set is a text-type data set in the field of network security; Based on the sample data set, a large language model is trained to obtain a pre-trained target large language model, and the pre-trained target large language model is used to perform security detection on the data to be detected.

6. The method according to claim 5, characterized in that The sample data set includes a first text data set and a second text data set, the first text data set is an unlabeled data set in the field of network security, and the second text data set is an artificially constructed labeled data set; The step of training a large language model based on the sample data set to obtain a pre-trained target large language model includes: Performing unsupervised pre-training on the large language model based on the first text dataset to obtain a trained large language model as a universal security model; The universal security model is supervisedly trained based on the second text data set to obtain the trained universal security model as the pre-trained target large language model.

7. A safety detection device, characterized in that: The device comprises: An input acquisition module is used to acquire the data to be detected; The result acquisition module is used to perform security detection on the data to be detected based on a pre-trained target large language model to obtain a security detection result for the data to be detected, wherein the target large language model is trained based on a corpus in the field of network security.

8. A model training device, characterized in that: The device comprises: A sample acquisition module is used to acquire a sample data set, where the sample data set is a text-type data set in the field of network security; The model training module is used to train a large language model based on the sample data set to obtain a pre-trained target large language model, and the pre-trained target large language model is used to perform security detection on the data to be detected.

9. A computer device, characterized in that: include: one or more processors; Memory; One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1-6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 6.

Images