Network security prediction method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a network security prediction method and device, electronic equipment and a storage medium. The method comprises the steps that a target prompt word corresponding to a current service scene is acquired, the target prompt word is constructed based on service data corresponding to the current service scene, and the service data is network data which is acquired in the current service scene and has the same data normal form as training data used when a prediction model is trained; and inputting the target cue word into the pre-trained prediction model, and obtaining a network security prediction result corresponding to the service data output by the prediction model. Through the method, in the field of network security, the prediction model can be guided to generate the result required by the service scene by designing the proper cue word, so that the target effect which is the same as that of a traditional service development scene in the field of network security is realized.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and specifically relates to a network security prediction method, device, electronic device and storage medium. Background Art

[0002] Network security refers to the protection of the hardware, software and data in the network system, which will not be damaged, changed or leaked due to accidental or malicious reasons, and the system will run continuously and reliably, and the network service will not be interrupted. The basic meaning of network security is that there is no threat objectively and no fear subjectively. That is, the object does not worry about its normal state being affected. Network security can be defined as: a network system is not subject to any threat or infringement, and can normally realize the resource sharing function. In order for the network to realize the resource sharing function normally, it is necessary to first ensure that the hardware and software of the network can operate normally, and then ensure the security of data information exchange. Due to the continuous development of the Internet, the number of terminals has gradually increased, and the devices used to connect to the Internet have increased exponentially. Therefore, it is very important to protect the data security in the devices used to connect to the Internet. For this reason, it is necessary to design a prediction method for network security to protect Internet security. Summary of the invention

[0003] In view of the above problems, the present application proposes a network security prediction method, device, electronic device and storage medium to improve the above problems.

[0004] In a first aspect, an embodiment of the present application provides a network security prediction method, the method comprising: obtaining a target prompt word corresponding to a current business scenario, the target prompt word being constructed based on business data corresponding to the current business scenario, the business data being network data obtained under the current business scenario and having the same data paradigm as the training data used when training a prediction model; inputting the target prompt word into the pre-trained prediction model, and obtaining a network security prediction result corresponding to the business data output by the prediction model.

[0005] Further, the obtaining of the target prompt word corresponding to the current business scenario includes: obtaining business data and a target prompt word template corresponding to the current business scenario, wherein the target prompt word template is a prompt word template that is obtained by predicting on the prediction model in advance and can achieve the downstream task goal; assembling the business data and the target prompt word template to obtain the target prompt word. Through the above method, different target prompt words are set for different downstream task goals to adapt, and target output results can be obtained for different subtasks.

[0006] Furthermore, the obtaining of the target prompt words corresponding to the current business scenario includes: obtaining the capability range of the prediction model; obtaining the question format preference of the prediction model; obtaining the original business data and downstream task objectives under the current business scenario; and constructing the target prompt words corresponding to the current business scenario based on the capability range of the prediction model, the question format preference, the original business data, and the downstream task objectives. By using the above method, the target prompt words are set according to the capability range and question format preference of the prediction model, which can shorten the time of exploring the best prompt words for the prediction model to adapt to the downstream tasks and improve the quality of the final output results of the large model.

[0007] Further, the obtaining of the capability range of the prediction model includes: inputting a first target question into the prediction model, obtaining knowledge corresponding to the first target question output by the prediction model, wherein the first target question is used to ask about learning sources in different professional fields; and determining the capability range of the prediction model based on the knowledge corresponding to the first target question output by the prediction model. Through the above method, the capability range of the prediction model can be clarified, so that the target prompt word can be defined within the capability range of the prediction model, and further, it can be ensured that the result output by the prediction model can meet the accuracy requirements.

[0008] Further, the obtaining of the question format preference of the prediction model includes: inputting a second target question into the prediction model, obtaining an output result corresponding to the second target question output by the prediction model, wherein the second target question is used to ask different question sentence patterns, and the output result represents the prediction model's understanding of the second target question; and determining the question format preference of the prediction model based on the output result corresponding to the second target question output by the prediction model. Through the above method, by asking questions of different data formats, a question format that is more conducive to the prediction model's understanding can be obtained.

[0009] Furthermore, the acquisition of the target prompt word corresponding to the current business scenario includes: acquiring the original business data under the current business scenario, the standard prediction results corresponding to the original business data, and the general prompt word template, wherein the original business data is the original network data obtained under the current business scenario and has not been processed; processing the original business data and the standard prediction results into the data format corresponding to the general prompt word template, and inputting them into the prediction model, obtaining multiple prediction instructions corresponding to the original business data output by the prediction model; and determining the target prompt word from the multiple prediction instructions. Through the above method, through an automated method of manually designing prompt words, the automated retrieval of candidate prompt words is combined with manual design and iteration, thereby accelerating the adaptation of downstream tasks.

[0010] Furthermore, determining the target prompt word from the multiple prediction instructions includes: obtaining evaluation scores corresponding to each of the multiple prediction instructions; and using the prediction instruction with the highest corresponding evaluation score among the multiple prediction instructions as the target prompt word.

[0011] In a second aspect, an embodiment of the present application provides a network security prediction device, which includes: a prompt word acquisition unit, used to obtain a target prompt word corresponding to a current business scenario, wherein the target prompt word is constructed based on business data corresponding to the current business scenario, and the business data is network data obtained under the current business scenario with the same data paradigm as the training data used when training the prediction model; a prediction unit, used to input the target prompt word into the pre-trained prediction model to obtain a network security prediction result corresponding to the business data output by the prediction model.

[0012] In a third aspect, an embodiment of the present application provides an electronic device, comprising one or more processors and a memory; one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above-mentioned method.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored, wherein the above method is executed when the program code is run.

[0014] The embodiments of the present application provide a network security prediction method, device, electronic device and storage medium. Obtain the target prompt word corresponding to the current business scenario, the target prompt word is constructed based on the business data corresponding to the current business scenario, the business data is the network data obtained in the current business scenario with the same data paradigm as the training data used when training the prediction model, and then input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model. Through the above method, in the field of network security, by designing appropriate prompt words, the prediction model can be guided to generate the results required by the business scenario, thereby achieving the same target effect as the business development scenario in the traditional network security field. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1A schematic diagram of an application scenario of a network security prediction method proposed in an embodiment of the present application is shown;

[0017] Figure 2 A schematic diagram of an application scenario of a network security prediction method proposed in an embodiment of the present application is shown;

[0018] Figure 3 A flowchart of a network security prediction method proposed in one embodiment of the present application is shown;

[0019] Figure 4 A flowchart of a network security prediction method proposed in another embodiment of the present application is shown;

[0020] Figure 5 A flowchart of a network security prediction method proposed in another embodiment of the present application is shown;

[0021] Figure 6 A structural block diagram of a network security prediction device proposed in an embodiment of the present application is shown;

[0022] Figure 7 A structural block diagram of an electronic device for executing a network security prediction method according to an embodiment of the present application is shown;

[0023] Figure 8 A storage unit in an embodiment of the present application is shown for storing or carrying program code for implementing a network security prediction method according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] In the field of network security, business scenarios or subtasks generally include detection, analysis, interpretation, etc. Taking the detection task as an example, the general process is: based on the knowledge and expert experience in the field of network security, various rules are developed, and on this basis, statistical or machine learning and artificial intelligence algorithms are used to construct detection models, process real business data, and mine security incidents.

[0026] When using detection models to process real business data and mine security incidents, different models and data processing modules are responsible for different subtasks. Ultimately, these models and modules are integrated or combined through some processes to achieve the detection tasks that need to be completed in the business scenarios.

[0027] The inventors found in their research on related network security prediction methods that there is no method that uses large language models and prompt engineering to achieve network security tasks. Prompt engineering refers to a method that guides large language models to generate target effect answers by designing and developing prompt words without updating model parameters.

[0028] Therefore, the inventors proposed the network security prediction method, device, electronic device and storage medium in the present application. Obtain the target prompt word corresponding to the current business scenario, the target prompt word is constructed based on the business data corresponding to the current business scenario, the business data is the network data obtained in the current business scenario with the same data paradigm as the training data used to train the prediction model, and then input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model. Through the above method, in the field of network security, by designing appropriate prompt words, the prediction model can be guided to generate the results required by the business scenario, thereby achieving the same target effect as the business development scenario in the traditional network security field.

[0029] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0030] In the embodiment of the present application, the network security prediction method provided can be executed by an electronic device. In this way, all steps in the network security prediction method provided by the embodiment of the present application can be executed by the electronic device. For example, Figure 1 As shown, the processor of the electronic device 100 executes to obtain the target prompt word corresponding to the current business scenario, and the target prompt word is constructed based on the business data corresponding to the current business scenario. The business data is network data obtained under the current business scenario and has the same data paradigm as the training data used when training the prediction model; the target prompt word is input into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0031] Furthermore, the network security prediction method provided in the embodiment of the present application can also be executed by a server (cloud). Correspondingly, in this mode of execution by the server, the server can execute to obtain the target prompt word corresponding to the current business scenario, the target prompt word is constructed based on the business data corresponding to the current business scenario, and the business data is the network data obtained in the current business scenario with the same data paradigm as the training data used when training the prediction model; the target prompt word is input into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0032] In addition, the electronic device and the server may also perform the steps in collaboration. In this mode, some steps of the network security prediction method provided by the embodiment of the present application are performed by the electronic device, while other steps are performed by the server.

[0033] For example, Figure 2 As shown, the electronic device 100 can execute the network security prediction method including: obtaining the target prompt word corresponding to the current business scenario, the target prompt word is constructed based on the business data corresponding to the current business scenario, the business data is the network data obtained under the current business scenario with the same data paradigm as the training data used when training the prediction model, and then the server 200 executes the input of the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0034] It should be noted that in this method of collaborative execution by the electronic device and the server, the steps respectively executed by the electronic device and the server are not limited to the methods introduced in the above examples. In actual applications, the steps respectively executed by the electronic device and the server can be dynamically adjusted according to actual conditions.

[0035] It should be noted that the electronic device 100 can be Figure 1 and Figure 2 In addition to the smartphone shown in the figure, it can also be a car device, a wearable device, a tablet computer, a laptop computer, a smart speaker, etc. The server 120 can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers.

[0036] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0037] See also Figure 3 The present application provides a network security prediction method, which is applied to Figure 1 or Figure 2 The electronic device or server shown, the method comprising:

[0038] Step S110: Obtain a target prompt word corresponding to the current business scenario, wherein the target prompt word is constructed based on business data corresponding to the current business scenario, and the business data is network data obtained under the current business scenario and has the same data paradigm as the training data used when training the prediction model.

[0039] In the embodiment of the present application, the current business scenario refers to a business scenario in the field of network security. In the field of network security, business scenarios or subtasks generally include detection, analysis, interpretation, etc. Among them, different target prompt words are designed in different business scenarios.

[0040] The prediction model refers to the Large Language Model (LLM). The Large Language Model is a pre-trained model, also known as a large model. The Large Language Model is an artificial intelligence model composed of hundreds of millions or billions of neural networks. It is trained on a large amount of text data, learns complex patterns in language data, and can perform a wide range of natural language understanding and generation tasks.

[0041] Training data refers to data processed into a preset data paradigm for training a prediction model. The training data may include business data in different business scenarios. By training the prediction model with the training data in different business scenarios, the trained prediction model can predict the business data in different business scenarios.

[0042] The target prompt is a prompt designed to prompt the prediction model to output the target effect answer. Among them, the prompt is also considered as an "instruction" in function. It is a form or template designed to make the large model perform well on downstream tasks. Usually, the prompt can be used as a clue or prompt, as additional text added to the input of the prediction model to help the prediction model "recall" what it has "learned" during training, so that it can better "understand" the questions entered by the user and give answers that better match the user's intentions.

[0043] Among them, the target prompt word is constructed based on the business data of the current business scenario obtained. Before constructing the target prompt word based on the business data of the current business scenario obtained, the original business data under the current business scenario can be obtained first, and then the original business data of the current business scenario obtained can be processed according to the data paradigm of the training data used when training the prediction model to obtain the business data, and then the business data can be assembled with the preset prompt word template to obtain the target prompt word corresponding to the current business scenario. Among them, the data paradigm refers to the preset data format, such as JSON format, natural language format, etc. The preset prompt word template is based on a general prompt word framework: instructions, background, input data, output requirements, and is tested on the prediction model in advance to obtain a prompt word template that can achieve downstream task goals.

[0044] Furthermore, in the embodiments of the present application, original business data refers to network data that has not been processed, wherein the original business data may be network traffic log statistics, risk access log statistics, and other network data related to network security, which are not specifically limited here.

[0045] When obtaining the original business data corresponding to the current business scenario, the network data generated in the current business scenario within a preset time period can be obtained as the original business data corresponding to the current business scenario. The preset time period is a time period preset for obtaining business data, for example, the preset time period can be set to half a month, or the preset time period can also be set to 1 day. The length of the preset time period can be set according to actual needs and is not specifically limited here.

[0046] Furthermore, the network data generated in the current business scenario within the preset time period may be the network data generated by the target network within the preset time period, wherein the target network may include one or more, which is not specifically limited herein.

[0047] Optionally, when acquiring the original business data, the original business data to be acquired may be determined according to the actual question currently input by the user, wherein the acquired original business data is the original business data related to the actual question used for output.

[0048] In the embodiment of the present application, the target prompt word corresponding to the current business scenario can be obtained in a variety of ways.

[0049] As a method, target prompt words corresponding to different business scenarios can be pre-set, and a correspondence between the target prompt words and the business scenarios can be established. Then, after the current business scenario is determined, the target prompt word corresponding to the current business scenario can be found based on the correspondence between the target prompt words and the business scenarios.

[0050] As another method, obtaining the target prompt word corresponding to the current business scenario includes: obtaining business data and a target prompt word template corresponding to the current business scenario, wherein the target prompt word template is a prompt word template that is obtained by predicting in advance on the prediction model and can achieve downstream task goals; assembling the business data and the target prompt word template to obtain the target prompt word.

[0051] The target prompt word template is a prompt word template that can achieve downstream task goals, based on a general prompt word framework and tested on the prediction model in advance. The general prompt word template can be: instruction + background + input data + output requirements. Downstream task goals refer to predicting attack types, predicting defense instructions, etc.

[0052] In the embodiment of the present application, assembling the business data and the target prompt word template may refer to processing the business data into the style of the target prompt word template, or may be understood as taking the business data and the target prompt word template together as inputs of the prediction model.

[0053] Step S120: input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0054] In an embodiment of the present application, after obtaining the target prompt word corresponding to the current business scenario, the target prompt word is input into a pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model, that is, the output content of the prediction model is the target result of the downstream task.

[0055] The network security prediction result may include whether a network attack or message propagation anomaly has occurred in the business data, or the network security prediction result may include multiple security defense instructions, etc. For example, network attacks may include jailbreaking, injection, leaking, etc.; multiple security defense instructions may include disabling the target network or blocking the network uplink when message propagation anomaly is predicted.

[0056] The present application provides a network security prediction method, which obtains the target prompt word corresponding to the current business scenario, and the target prompt word is constructed based on the business data corresponding to the current business scenario, and the business data is the network data obtained in the current business scenario with the same data paradigm as the training data used when training the prediction model, and then the target prompt word is input into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model. Through the above method, in the field of network security, by designing appropriate prompt words, the prediction model can be guided to generate the results required by the business scenario, thereby achieving the same target effect as the business development scenario in the traditional network security field.

[0057] See also Figure 4 The present application provides a network security prediction method, which is applied to Figure 1 or Figure 2 The electronic device or server shown, the method comprising:

[0058] Step S210: Obtain the capability range of the prediction model.

[0059] In the embodiment of the present application, the capability scope of the prediction model refers to the reliability of the knowledge in the specific professional field that the prediction model has memorized.

[0060] It is known that large language models and prompt learning modes have been widely used in various business fields recently. In order to enable large language models to better reflect their capabilities in downstream tasks, prompt words play an important role as a bridge between models and tasks. Generally, taking the conversational large language model as an example, the industry has experience in prompt word design. The designed prompt words are generally composed of instructions, context or background information, input data, output requirements, etc., such as the CRISPE (CRISPE Prompt Framework) prompt word framework. Based on this framework, when using large language models and prompt learning modes to implement downstream tasks, prompt words can be designed in combination with actual business needs. Among them, CRISPE prompt word framework (CRISPE Prompt Framework): a prompt word framework proposed by Matt Nigh for writing prompt word templates. It consists of the following parameters: Capacity and Role (CR), Insight (I), Statement (S), Personality (P), and Experiment (E).

[0061] However, in actual application and deployment, although the aforementioned general prompt word design experience can bring intuitive effects, when the downstream task belongs to a professional field task with high accuracy requirements, the existing prompt word design experience has a broad guiding large language model output that cannot meet business needs or the output effect is not obvious.

[0062] In addition, considering that different large language models have different original training data, when the prompt words and questions are used as model input at the same time, in order to obtain the target model output, the specific content of the prompt words is different for different large language models. It is necessary to explore the specific optimal prompt words for different large language models.

[0063] The embodiment of the present application proposes a general prompt word design method and process, which can be applied to different large language models, different professional fields / business scenarios / downstream tasks, and can shorten the time for exploring the best prompt words for adapting the large language model to downstream tasks and improve the final output content quality of the large language model.

[0064] The specific process of the target prompt word is as follows:

[0065] 1. Prior Experiment (Evaluation)

[0066] For business scenarios with accuracy requirements, when the prediction model is a black box (that is, the specific business capabilities of the prediction model have not been evaluated or the training data is unknown), the following experiments can be conducted to clarify the prior knowledge of the prediction model, that is, to clarify the capability scope of the prediction model.

[0067] As one method, obtaining the capability scope of the prediction model includes: inputting a first target question into the prediction model, obtaining knowledge corresponding to the first target question output by the prediction model, wherein the first target question is used to ask about learning sources in different professional fields; and determining the capability scope of the prediction model based on the knowledge corresponding to the first target question output by the prediction model.

[0068] Among them, professional fields can be areas related to network security, such as firewall / NGFW (Next Generation Firewall) / UTM (Unified Threat Management), network gate technology, intrusion detection / prevention, VPN (Virtual Private Network) gateway (IPsec (Internet Protocol Security) / SSL (Secure Socket Layer)), anti-DDOS (Distributed Denial of Service), Internet behavior management, load balancing / application delivery, traffic analysis, vulnerability scanning and other technical fields.

[0069] In the embodiment of the present application, the knowledge that has been memorized can be obtained by asking the prediction model about the learning source of a certain professional field. Among them, the professional field can be determined according to the downstream task goal, and the professional field is the field corresponding to the downstream task goal.

[0070] After the first target question is input into the prediction model, the prediction model can output an output result corresponding to the first target question, and the output result is the relevant knowledge of the professional field asked in the first target question. Among them, the first target question can include one or more professional fields, which are not specifically limited here.

[0071] Of course, the number of professional fields included in the first target question can be determined according to the downstream task goal. Specifically, if the downstream task goal is to predict the business data of one professional field, then it can be determined that the first target question only includes one professional field; if the downstream task goal is to predict the business data of multiple different professional fields, then it can be determined that the first question can include multiple different professional fields.

[0072] After acquiring the knowledge that the prediction model has memorized, professionals can evaluate the knowledge that the prediction model has memorized to determine the reliability of the knowledge that the prediction model has memorized, that is, to define the scope of the prediction model's capabilities in a specific professional field, so as to further define and modify downstream tasks and business scenarios to ensure that the output of the prediction model can meet the accuracy requirements.

[0073] Step S220: Obtain the question format preference of the prediction model.

[0074] In the embodiment of the present application, the question format preference refers to the question format with high reliability of the output result of the prediction model. The prediction model can be asked common question sentences to obtain the prediction model's understanding of different question formats.

[0075] As one method, the question format preference of the prediction model is obtained, including: inputting a second target question into the prediction model, obtaining an output result corresponding to the second target question output by the prediction model, wherein the second target question is used to ask different question sentences, and the output result represents the prediction model's understanding of the second target question; based on the output result corresponding to the second target question output by the prediction model, determining the question format preference of the prediction model.

[0076] In the embodiment of the present application, the second target question can be the same as asking questions about the learning sources in the aforementioned specific professional field through different question sentence patterns.

[0077] Among them, the second target question can be used to ask questions about the specific data format, so as to obtain a format that is more conducive to understanding the prediction model, such as JSON format / natural language format, etc.

[0078] In the embodiment of the present application, one second target question can be used to ask a question of one question sentence pattern. If different question sentence patterns need to be asked, multiple second target questions can be input into the prediction model. Of course, one second target question can also be used to ask multiple question sentence patterns.

[0079] For example, the following is an example (where A is a professional field), the second target question can be:

[0080] There are two ways to ask questions:

[0081] Method 1: "Can you give the specific source you used to learn knowledge A?"

[0082] Method 2: "The sources of my knowledge of A include the following:"

[0083] How is your answer different? Please explain in detail.

[0084] The above-mentioned second target question is input into the prediction model, and the prediction model can output the understanding of different question formats.

[0085] Through steps S210 and S220, the capability scope / role / question format preference / data preference, etc. of the prediction model actually used can be obtained.

[0086] 2. Target prompt word construction

[0087] Combined with: (1) the capability scope / role / question format preference / data preference of the prediction model actually used obtained in 1; (2) actual business data; (3) actual business / downstream task objectives.

[0088] Combining the contents of these three parts, the actual business data is reconstructed to construct the target prompt words. The prompt words constructed in this mode are within the capability range of the prediction model and belong to the data format that the prediction model understands well, thus improving the prediction effect on the downstream tasks.

[0089] The steps of constructing the target prompt word are shown in step S230 and step S240.

[0090] Step S230: Acquire original business data and downstream task targets in the current business scenario.

[0091] In the embodiment of the present application, the aforementioned actual business data refers to the original business data. The downstream task target can be a pre-set prediction target under the current business scenario.

[0092] As a method, all original business data of a preset time period can be obtained, and then all original business data can be classified according to business scenarios, and a correspondence between business scenarios, original business data, and downstream task objectives can be established. After the current business scenario is determined, the original business data and downstream task objectives corresponding to the current business scenario can be directly obtained based on the correspondence between business scenarios, original business data, and downstream task objectives.

[0093] Step S240: constructing target prompt words corresponding to the current business scenario based on the capability scope of the prediction model, the question format preference, the original business data and the downstream task goal.

[0094] In an embodiment of the present application, the original business data corresponding to the current business scenario is reconstructed in combination with the capability scope of the prediction model, the question format preference, the original business data, and the downstream task objectives, and the original business data is processed into prompt words that are within the capability scope of the prediction model and in a data format that the prediction model can understand better, so as to obtain the target prompt words.

[0095] Step S250: input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0096] In an embodiment of the present application, after obtaining the target prompt word in the aforementioned manner, the target prompt word is input into the prediction model to obtain the network security prediction result output by the prediction model, and the network security prediction result output by the prediction model is compared with the target effect of the downstream task goal. If the network security prediction result output by the prediction model does not achieve the target effect of the downstream task goal, then return to S230 and S240, and reconstruct a new target prompt word until the network security prediction result output by the prediction model achieves the target effect of the downstream task goal.

[0097] The present application provides a network security prediction method, which constructs target prompt words according to the capability range of the prediction model, the question format preference, the original business data in the current business scenario, and the downstream task objectives, so as to make the downstream tasks as close as possible to the capabilities of the prediction model, thereby achieving better downstream task effects in this mode.

[0098] See also Figure 5 , a network security prediction method provided by an embodiment of the present application is applied to an electronic device, the method comprising:

[0099] Step S310: obtaining original business data in the current business scenario, standard prediction results corresponding to the original business data, and a general prompt word template, wherein the original business data is original network data obtained in the current business scenario and has not been processed.

[0100] It can be known that in the actual business scenarios of large language model applications, the use of prompt engineering, that is, prompt mode, can quickly meet business needs. In the case of zero or small samples, the prompt mode inputs the designed prompt words into the large language model, so that the large language model can be generalized without modifying the basic structure, modifying model parameters, retraining or fine-tuning. This "large language model-prompt word-downstream task" model transforms the input and output form of the downstream task into a form that fits the distribution of large language model training data, so that business needs can be quickly met.

[0101] In actual situations, based on a large language model, there will be multiple business scenarios / downstream tasks that need to be developed; in addition, the prompt words themselves are not robust enough, simple manual design has unknowns, and the efficiency of exploring the best prompt words is low. Relevant schemes for selecting prompt words can include: (1) discrete type, using some evaluation formulas and functions to score candidate prompt words; (2) continuous type, using the target output of business needs / downstream tasks as labels to define a supervised training task for prompt words. In actual operation, continuous prompt words (i.e., prompt word fine-tuning) have high resource consumption and high cost, and cannot meet the requirements of rapid adaptation and iteration of downstream tasks.

[0102] Therefore, the embodiment of the present application proposes a method for automated auxiliary manual design of prompt words, which combines automated retrieval of candidate prompt words with manual design and iteration, thereby accelerating the adaptation of downstream tasks.

[0103] In the embodiment of the present application, the workflow of automatically searching for candidate prompt words is as follows:

[0104] 1. Obtaining original business data in the current business scenario, standard prediction results corresponding to the original business data, and a general prompt word template, such as S310.

[0105] The general prompt word template is a pre-set general prompt word template, which is mainly used to indicate outputting prediction results according to input data.

[0106] When obtaining the original business data in the current business scenario, it can be obtained in the aforementioned manner, which will not be repeated here.

[0107] The standard prediction results corresponding to the original business data may be the prediction results corresponding to the original business data output by some trained large language models.

[0108] 2. Based on the original business data and the standard prediction results corresponding to the original business data, use the general prompt word template, input the prediction model, and obtain a series of possible prediction instructions, such as S320.

[0109] 3. Use the evaluation function to calculate the scores of each predicted instruction, and use the predicted instruction with the highest score as the final prompt word, such as S330 and S340.

[0110] Step S320: Process the original business data and the standard prediction results into a data format corresponding to the universal prompt word template, and input them into the prediction model to obtain multiple prediction instructions corresponding to the original business data output by the prediction model.

[0111] In an embodiment of the present application, when a general prompt word template is used to input a prediction model based on the original business data and the standard prediction results corresponding to the original business data to obtain a series of possible prediction instructions, the original business data and the standard prediction results are first processed into a data format corresponding to the general prompt word template, and then the processed original business data and the standard prediction results are input into the prediction model, so that multiple prediction instructions output by the prediction model based on the original business data and the standard prediction results can be obtained, and the multiple prediction instructions can be understood as multiple candidate prompt words.

[0112] Step S330: Determine a target prompt word from the multiple predicted instructions.

[0113] In the embodiment of the present application, after obtaining multiple candidate prompt words, the evaluation scores corresponding to the multiple candidate prompt words can be determined by an evaluation function, so that the target prompt word can be determined from the multiple candidate prompt words according to the evaluation scores corresponding to the multiple candidate prompt words.

[0114] As one method, determining the target prompt word from the multiple prediction instructions includes: obtaining evaluation scores corresponding to each of the multiple prediction instructions; and using the prediction instruction with the highest corresponding evaluation score among the multiple prediction instructions as the target prompt word.

[0115] The evaluation function may be a regression function or a classification function, which is not specifically limited here.

[0116] Step S340: input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0117] The present application provides a network security prediction method that combines automatic retrieval of candidate prompt words with manual design and iteration, thereby accelerating the adaptation of downstream tasks.

[0118] See also Figure 6 The network security prediction device 400 provided in the embodiment of the present application runs on Figure 1 The electronic device or server shown, the device 400 includes:

[0119] The prompt word acquisition unit 410 is used to obtain the target prompt word corresponding to the current business scenario. The target prompt word is constructed based on the business data corresponding to the current business scenario. The business data is network data obtained in the current business scenario with the same data paradigm as the training data used when training the prediction model.

[0120] As a method, the prompt word acquisition unit 410 is specifically used to obtain business data and a target prompt word template corresponding to the current business scenario, wherein the target prompt word template is a prompt word template that is obtained by predicting in advance on the prediction model and can achieve the downstream task goals; the business data and the target prompt word template are assembled to obtain the target prompt word.

[0121] As another method, the prompt word acquisition unit 410 is also specifically used to obtain the capability scope of the prediction model; obtain the question format preference of the prediction model; obtain the original business data and downstream task goals in the current business scenario; and construct the target prompt words corresponding to the current business scenario based on the capability scope of the prediction model, the question format preference, the original business data and the downstream task goals.

[0122] Among them, the prompt word acquisition unit 410 is used to input the first target question into the prediction model, obtain the knowledge corresponding to the first target question output by the prediction model, and the first target question is used to ask about the learning sources in different professional fields; based on the knowledge corresponding to the first target question output by the prediction model, determine the ability scope of the prediction model.

[0123] Among them, the prompt word acquisition unit 410 is used to input the second target question into the prediction model, and obtain the output result corresponding to the second target question output by the prediction model, wherein the second target question is used to ask different question sentences, and the output result represents the prediction model's understanding of the second target question; based on the output result corresponding to the second target question output by the prediction model, the question format preference of the prediction model is determined.

[0124] Optionally, the prompt word acquisition unit 410 is also specifically used to obtain original business data in the current business scenario, standard prediction results corresponding to the original business data, and a general prompt word template, wherein the original business data is the original network data that has not been processed and obtained in the current business scenario; the original business data and the standard prediction results are processed into a data format corresponding to the general prompt word template, and input into the prediction model to obtain multiple prediction instructions corresponding to the original business data output by the prediction model; and the target prompt word is determined from the multiple prediction instructions.

[0125] Furthermore, the prompt word acquisition unit 410 is further specifically configured to acquire evaluation scores corresponding to each of the plurality of prediction instructions; and to use the prediction instruction with the highest corresponding evaluation score among the plurality of prediction instructions as the target prompt word.

[0126] The prediction unit 420 is used to input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

[0127] It should be noted that the device embodiment in the present application corresponds to the aforementioned method embodiment. The specific principles in the device embodiment can be found in the contents of the aforementioned method embodiment and will not be repeated here.

[0128] The following will be combined Figure 7 An electronic device or server provided in the present application is described.

[0129] See also Figure 7 Based on the above network security prediction method and device, the embodiment of the present application also provides another electronic device or server 800 that can execute the above network security prediction method. The electronic device or server 800 includes one or more (only one is shown in the figure) processors 802, a memory 804 and a network module 806 that are coupled to each other. Among them, the memory 804 stores a program that can execute the content of the above embodiment, and the processor 802 can execute the program stored in the memory 804.

[0130] Among them, the processor 802 may include one or more processing cores. The processor 802 uses various interfaces and lines to connect the various parts of the entire electronic device or server 800, and executes various functions and processes data of the electronic device 800 by running or executing instructions, programs, code sets or instruction sets stored in the memory 804, and calling data stored in the memory 804. Optionally, the processor 802 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 802 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 802, but may be implemented separately through a communication chip.

[0131] The memory 804 may include a random access memory (RAM) or a read-only memory (ROM). The memory 804 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 804 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the electronic device or server 800 during use.

[0132] The network module 806 is used to receive and send electromagnetic waves, realize the mutual conversion between electromagnetic waves and electrical signals, so as to communicate with a communication network or other devices, such as communicating with electronic devices. The network module 806 may include various existing circuit elements for performing these functions, such as antennas, radio frequency transceivers, digital signal processors, encryption / decryption chips, user identity modules (SIM) cards, memories, etc. The network module 806 may communicate with various networks such as the Internet, corporate intranets, wireless networks, or communicate with other devices via wireless networks. The above-mentioned wireless networks may include cellular telephone networks, wireless local area networks, or metropolitan area networks. For example, the network module 806 may exchange information with a base station.

[0133] Please refer to Figure 8 , which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable storage medium 900 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0134] The computer-readable storage medium 900 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 900 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 900 has storage space for program code 910 that performs any method step in the above method. These program codes can be read from or written to one or more computer program products. The program code 910 can be compressed, for example, in an appropriate form.

[0135] The present application provides a network security prediction method, device, electronic device and storage medium, which obtains the target prompt word corresponding to the current business scenario, and the target prompt word is constructed based on the business data corresponding to the current business scenario, and the business data is the network data obtained in the current business scenario with the same data paradigm as the training data used when training the prediction model, and then the target prompt word is input into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model. Through the above method, in the field of network security, by designing appropriate prompt words, the prediction model can be guided to generate the results required by the business scenario, thereby achieving the same target effect as the business development scenario in the traditional network security field.

[0136] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A network security prediction method, characterized in that: The method comprises: Obtaining a target prompt word corresponding to the current business scenario, wherein the target prompt word is constructed based on business data corresponding to the current business scenario, wherein the business data is network data obtained under the current business scenario and having the same data paradigm as the training data used when training the prediction model; The target prompt word is input into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

2. The method according to claim 1, characterized in that The step of obtaining the target prompt word corresponding to the current business scenario includes: Obtaining business data and a target prompt word template corresponding to the current business scenario, wherein the target prompt word template is a prompt word template that is obtained by performing a prediction on the prediction model in advance and can achieve the downstream task goal; The business data and the target prompt word template are assembled to obtain the target prompt word.

3. The method according to claim 1, characterized in that: The step of obtaining the target prompt word corresponding to the current business scenario includes: Obtaining the capability scope of the prediction model; Obtaining a question format preference of the prediction model; Obtain the original business data and downstream task objectives in the current business scenario; Based on the capability scope of the prediction model, the question format preference, the original business data and the downstream task goal, a target prompt word corresponding to the current business scenario is constructed.

4. The method according to claim 3, characterized in that The capability scope of obtaining the prediction model includes: Inputting a first target question into the prediction model, and acquiring knowledge corresponding to the first target question output by the prediction model, wherein the first target question is used to inquire about learning sources in different professional fields; Based on the knowledge corresponding to the first target question output by the prediction model, the capability scope of the prediction model is determined.

5. The method according to claim 3, characterized in that: The obtaining of the question format preference of the prediction model includes: Inputting a second target question into the prediction model, and obtaining an output result corresponding to the second target question output by the prediction model, wherein the second target question is used to ask different question sentence patterns, and the output result represents the prediction model's understanding of the second target question; Based on an output result corresponding to the second target question output by the prediction model, a question format preference of the prediction model is determined.

6. The method according to claim 1, characterized in that The step of obtaining the target prompt word corresponding to the current business scenario includes: Acquire original business data in the current business scenario, standard prediction results corresponding to the original business data, and a general prompt word template, wherein the original business data is original network data obtained in the current business scenario and has not been processed; Processing the original business data and the standard prediction results into a data format corresponding to the universal prompt word template, and inputting the data into the prediction model, and obtaining a plurality of prediction instructions corresponding to the original business data output by the prediction model; A target cue word is determined from the plurality of predicted instructions.

7. The method according to claim 6, characterized in that Determining a target prompt word from the plurality of predicted instructions includes: Obtaining evaluation scores corresponding to each of the plurality of prediction instructions; The predicted instruction with the highest corresponding evaluation score among the multiple predicted instructions is used as the target prompt word.

8. A network security prediction device, characterized in that: The device comprises: A prompt word acquisition unit, used to acquire a target prompt word corresponding to the current business scenario, wherein the target prompt word is constructed based on business data corresponding to the current business scenario, wherein the business data is network data acquired in the current business scenario and has the same data paradigm as the training data used in training the prediction model; The prediction unit is used to input the target prompt word into the pre-trained prediction model to obtain the network security prediction result corresponding to the business data output by the prediction model.

9. An electronic device, characterized in that: The method comprises one or more processors; one or more programs are stored in the memory and configured to execute the method according to any one of claims 1 to 7 by the one or more processors.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, wherein when the program code is executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images