Efficient construction method of network security instruction fine tuning data set

Abstract

The invention provides an efficient construction method of a network security instruction fine tuning data set. The method comprises the following steps: carrying out subject classification on related knowledge in a network security field; aiming at each theme, generating network security instructions in batches by utilizing a GPT large model; according to the instruction reply generation template, circularly calling the GPT large model to generate a responded instruction reply; converting the generated network security instruction and the responded instruction reply into network security instruction data in a preset format; performing quality examination on the network security instruction data, removing unqualified instruction data, and regenerating an instruction reply and constructing the instruction data until the quantity of the instruction data of the theme reaches a set value; and summarizing the network security instruction data of all themes to form a complete network security instruction fine tuning data set. According to the method, the network security instruction fine tuning data set can be constructed under the conditions of short time consumption and low cost, and rapid construction and application landing of a network security vertical field large model are supported.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for efficiently constructing a network security instruction fine-tuning data set. Background Art

[0002] In the field of cybersecurity, fine-tuning a general large model is a method that can improve its professional domain knowledge and ability to handle domain tasks. In order to fine-tune a large model with strong capabilities in cybersecurity, high-quality cybersecurity instruction data is needed as a basis. A high-quality cybersecurity instruction fine-tuning dataset should have the following characteristics: complete subject classification to systematically cover various sub-fields of cybersecurity; remove low-quality data, such as data with high repetition, low relevance to the topic, unclear questions or wrong answers. However, the current number of datasets in the field of cybersecurity is small, and systematic high-quality datasets are even more scarce. Manually generating and annotating datasets is costly and time-consuming, making it difficult to achieve large-scale application. Summary of the invention

[0003] In response to the problems existing in the existing technology, this paper provides an efficient construction method for a network security instruction fine-tuning dataset, which can quickly generate a complete, systematic and high-quality network security dataset, solving the problem of lack of fine-tuning data for large model training in the vertical field of network security.

[0004] The first aspect of the present invention proposes an efficient construction method for a network security instruction fine-tuning dataset, comprising:

[0005] To classify the relevant knowledge in the field of cybersecurity by subject;

[0006] For each topic, use the GPT large model to batch generate cybersecurity instructions;

[0007] Generate a template for the command reply based on the generated batch of commands, and cyclically call the GPT large model to generate the corresponding command reply;

[0008] Convert the generated network security instructions and the response instruction replies into network security instruction data in a preset format;

[0009] Conduct a quality review of the cybersecurity instruction data, remove unqualified instruction data, and regenerate instruction replies, incrementally constructing instruction data until the amount of cybersecurity instruction data for the subject reaches a preset value;

[0010] Aggregate the cybersecurity instruction data of all topics to form a complete cybersecurity instruction fine-tuning dataset.

[0011] As a preferred solution, the subject classification includes: network security architecture, cryptographic technology, infrastructure security, supply chain security, data security, terminal security, attack methods and penetration testing, threat detection and analysis, emergency response and disposal, and AI and network security.

[0012] As a preferred solution, the use of the GPT large model to batch generate network security instructions specifically includes:

[0013] Generate network security instructions using the GPT large model;

[0014] Filter similar network security instructions;

[0015] The process of generating and filtering is repeated until the required number of network security instructions are generated.

[0016] As a preferred solution, the use of the GPT large model to generate network security instructions specifically includes:

[0017] Determine the generated theme;

[0018] Set the number of batch generation instructions;

[0019] The GPT large model is used to generate templates according to instructions to complete the generation of network security instructions.

[0020] As a preferred solution, the filtering of similar network security instructions specifically includes:

[0021] Use an embedding model or a pre-trained language model to convert each generated instruction text into a vector representation;

[0022] Use cosine similarity to calculate the similarity between instruction vectors;

[0023] The similarities between all instruction vectors are traversed and compared with the preset similarity threshold. When the instruction similarity value is less than the preset similarity threshold, two instructions are retained; when the instruction similarity value is greater than the preset similarity threshold, only one instruction is retained.

[0024] As a preferred solution, the process of repeatedly generating and filtering until a required number of network security instructions are generated specifically includes:

[0025] After filtering similar instructions, the number of instructions needs to be supplemented, and the GPT large model is used to generate the difference instructions; then the newly generated instructions are mixed with the original instructions for similarity calculation, and instructions with too high similarity are eliminated. The cycle continues until the total number of instructions generated reaches the set value, and the similarity between each instruction is lower than the preset similarity threshold.

[0026] As a preferred solution, the preset format includes a network security theme, a corresponding generated instruction, a supplement to the instruction content, and an answer to the corresponding instruction.

[0027] As a preferred solution, the network security instruction data is subject to quality review, specifically including:

[0028] Determine whether the response to the command is too short or too long, if so, it means it is unqualified;

[0029] Determine whether the reply to the command matches the input command, if not, it is unqualified;

[0030] Determine whether the reply to the command correctly answers the input command, if not, it is unqualified.

[0031] A second aspect of the present invention proposes a system including a memory and a processor, wherein the memory stores a computer program corresponding to the efficient construction method of the network security instruction fine-tuning data set as described in the first aspect and can be loaded by the processor to execute.

[0032] A third aspect of the present invention proposes a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, are used to implement a process corresponding to the method for efficiently constructing a network security instruction fine-tuning data set described in the first aspect.

[0033] Compared with the prior art, the beneficial effects of adopting the above technical solution are as follows: the present invention solves the problem of lack of data for fine-tuning training of large models in the vertical field of network security. By dividing topics, generating instructions in batches by topic, and then generating instruction replies for each instruction, the excellent performance of the GPT4 level large model is fully utilized to generate instruction fine-tuning data in batches. It is possible to construct a network security instruction fine-tuning data set in a shorter time and at a lower cost, supporting the rapid construction and application of large models in the vertical field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flow chart of a method for efficiently constructing a network security instruction fine-tuning dataset according to an embodiment of the present invention.

[0035] Figure 2 This is a classification of topics in the field of network security in one embodiment of the present invention.

[0036] Figure 3 The figure is a schematic diagram of a process of batch generating network security instructions in one embodiment of the present invention. DETAILED DESCRIPTION

[0037] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar modules or modules with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be construed as limitations on the present application. On the contrary, the embodiments of the present application include all changes, modifications and equivalents that fall within the spirit and connotation of the appended claims.

[0038] In order to solve the problem of lack of fine-tuning data for large models in the vertical field of network security, the embodiment of the present invention proposes an efficient construction method for a network security instruction fine-tuning dataset. By dividing the topics, generating instructions in batches by topic, and then generating instruction replies for each instruction, the excellent performance of the GPT4level large model is fully utilized to generate instruction fine-tuning data in batches. It is possible to construct a network security instruction fine-tuning dataset in a shorter time and at a lower cost, supporting the rapid construction and application of large models in the vertical field of network security. Please refer to Figure 1 , the specific plan is as follows:

[0039] Step 1: Classify the relevant knowledge in the field of network security by subject.

[0040] Before generating instruction data in the field of cybersecurity, it is necessary to classify it by subject. The purpose of this step is to ensure that the generated data can comprehensively and systematically cover various topics in the field of cybersecurity. The subject classification is based on relevant knowledge and professional experience in the field of cybersecurity. Through the understanding and induction of relevant concepts, technologies and problems in the field, they are classified into different topics.

[0041] Please refer to Figure 2 In this embodiment, the subject classification in the field of network security is divided into the following ten categories: network security architecture, cryptographic technology, infrastructure security, supply chain security, data security, terminal security, attack methods and penetration testing, threat detection and analysis, emergency response and disposal, and AI and network security.

[0042] By classifying topics, we can more comprehensively cover different aspects of the cybersecurity field, and provide clear guidance for subsequent instruction data generation. Each topic will become an independent set of generated data to ensure that each topic can be fully covered and explored. In this way, the generated dataset will be complete and systematic, and can meet the needs of the cybersecurity field.

[0043] It should be noted that the above ten categories are only exemplary descriptions in this embodiment and are not fixed. In actual applications, they can be adjusted according to needs. At the same time, each topic can also be classified twice.

[0044] Step 2: Use the GPT large model to batch generate network security instructions.

[0045] Select any topic and use a large model at the GPT4 level (GPT4 or a large model with performance similar to GPT4 can be used) to generate instructions in batches according to the topic. In this embodiment, the instruction includes the instruction and input of each data, where the input is the supplementary content of the instruction and can be left blank.

[0046] Please refer to Figure 3 In this embodiment, the gpt-4o commercial big model is selected as the big model for batch generation of network security instructions, and then the number of batch generated instructions and the generation theme are determined, such as "attack methods and penetration testing". Finally, the big model is used to batch generate instructions through the preset instruction generation prompt template. A reference example of an instruction generation prompt template is as follows:

[0047] #01You are an expert in the field of cybersecurity and are good at raising in-depth cybersecurity issues.

[0048] #02 Your task is to generate questions suitable as question-answering datasets based on the given content, i.e. instructions. The questions should be professional and have a certain depth in the field.

[0049] #03 Questions can only be generated in Chinese or English. One or two questions per sentence at most. The expression should be clear and unambiguous.

[0050] #04 The language used in instruction descriptions should be diverse. Try not to repeat the verbs in each instruction to maximize diversity. For example, you can use an imperative tone or euphemistic expressions.

[0051] #05 The instructions generated should be able to let the GPT language model complete the instructions and output the answer. For example, don't let the assistant create any visual or audio output because it can't perform any actions.

[0052] #06 The generated instructions should provide substantive content, contain professional data in the field of cybersecurity, and should not contain simple placeholders.

[0053] #07 Instructions should be **challenging and diverse**, including questions about professional knowledge and designing specific tasks, such as giving a piece of traffic information or log information for the GPT language model to analyze.

[0054] #08Ideally each instruction should not exceed 200 words.

[0055] #09 Ensure generated instructions are grammatically correct, adding punctuation where necessary.

[0056] #10 The number of instructions generated is **{{num_instruction}}**. The semantics of each instruction generated should be obviously different, rich and without duplication.

[0057] #11 You must output the generated {{num_instruction}} instructions strictly in list form. Each element in the list is an instruction. The format example is as follows:

[0058] ["instruction_0","instruction_1",...,"instruction_num"]

[0059] #12 Now please follow the above requirements to generate a list of instructions related to {{topic name}} in the field of network security.

[0060] #13 The generated question (instruction) seed example is as follows:

[0061] ["Here is the seed example 1.","Here is the seed example 2.","Here is the seed example 3."]

[0062] For the topic "Attack Methods and Penetration Testing", the seed setting example is as follows:

[0063] ["Describe the common types of DDoS attacks and explain how to effectively defend against each type?", "When using SQLMap for SQL injection, SQLMap will output some information, which is divided into 7 levels from simple to complex. What does each level mean?", "In fuzz testing, what is the advantage of "persistent mode"? "]

[0064] Assuming that the number of instructions generated in a batch is 10, the instructions generated using the large model are as follows:

[0065] ['How to use the Metasploit framework for vulnerability scanning and penetration testing? Please provide specific steps. ','What are the social engineering attack methods commonly used by hackers? How to prevent these attacks? ','Explain what cross-site scripting attacks (XSS) are and provide best practices for defending against such attacks. ','Describe the principles of buffer overflow attacks and explain how to detect and defend against such attacks. ','In penetration testing, how to use Wireshark for packet analysis? Please describe the steps in detail. ','Explain the working mechanism of phishing attacks and provide effective measures to prevent phishing. ','How to use BurpSuite for web application penetration testing? Please describe the specific testing process. ','Describe how to use Nmap for network scanning and explain the meaning of the scan results. ','What is a SQL injection attack? How to defend against this attack through code review and input validation? ','Explain what an ARP spoofing attack is and provide specific methods to detect and defend against such attacks. ']

[0066] Given that the GPT4-level large model has strong semantic understanding and instruction-following capabilities, each instruction generated is of high quality. Therefore, in this embodiment, the focus is on the similarity between instructions, and instructions with high similarity are filtered out. The specific steps are as follows:

[0067] ① Use an embedding model or a pre-trained language model to convert each generated instruction text into a vector representation;

[0068] ② Use cosine similarity to calculate the similarity between instruction vectors;

[0069] ③Set the preset similarity threshold according to actual needs;

[0070] ④ Traverse the similarities between all instruction vectors and compare them with the preset similarity threshold. When the instruction similarity value is less than the preset similarity threshold, keep two instructions; when the instruction similarity value is greater than the preset similarity threshold, only keep one instruction.

[0071] Taking the 10 instructions generated above as an example, the 10 Chinese instructions generated are converted into vector representations, and these 10 instructions are assigned IDs from 1 to 10. Next, the instruction similarity matrix is ​​calculated using cosine similarity as shown in the following table:

[0072] Table 1 Instruction similarity matrix

[0073]

[0074] Since the generated instructions all belong to the field of network security and belong to the same topic, the similarity value of the instructions is relatively high. In this embodiment, the similarity threshold is set to 0.95 for illustration, and it can be adjusted according to needs in actual applications. After filtering, 8 instructions are retained in the instruction list, and the specific contents are as follows:

[0075] ['How to use Metasploit framework for vulnerability scanning and penetration testing? Please provide specific steps. ','What are the social engineering attack methods commonly used by hackers? How to prevent these attacks? ','Explain what cross-site scripting (XSS) attacks are and provide best practices for defending against such attacks. ','Describe the principles of buffer overflow attacks and explain how to detect and defend against such attacks. ','Explain the working mechanism of phishing attacks and provide effective measures to prevent phishing. ','How to use Burp Suite for web application penetration testing? Please describe the specific testing process. ','Describe how to use Nmap for network scanning and explain the meaning of the scan results. ','What is a SQL injection attack? How to defend against this attack through code review and input validation? ']

[0076] Since some instructions are eliminated due to high similarity, the number of remaining instructions is insufficient to meet the set value of batch instructions. Therefore, it is necessary to repeat the process of instruction generation and filtering, that is, to use the GPT-4o business model to generate additional difference instructions. Subsequently, the newly generated instructions are mixed with the original instructions for similarity calculation, and instructions with too high similarity are eliminated. This process is repeated until the total number of instructions generated reaches the set value and the similarity between each instruction is lower than the set threshold.

[0077] In the above example, due to the high similarity of some instructions, only 8 instructions are retained from the 10 instructions. In order to meet the demand of generating 10 instructions, the large model is reused to generate 2 additional instructions. Then, the similarity of the newly generated 2 instructions is calculated pairwise with the original 8 instructions, and the instructions with too high similarity are eliminated. The above steps are repeated until 10 instructions with similarity below the threshold are generated. The final instruction list is as follows:

[0078] ['How to use the Metasploit framework for vulnerability scanning and penetration testing? Please provide specific steps. ','What are the social engineering attack methods commonly used by hackers? How to prevent these attacks? ','Explain what cross-site scripting attacks (XSS) are and provide best practices for defending against such attacks. ','Describe the principles of buffer overflow attacks and explain how to detect and defend against such attacks. ','Explain the working mechanism of phishing attacks and provide effective measures to prevent phishing. ','How to use Burp Suite for web application penetration testing? Please describe the specific testing process. ','Describe how to use Nmap to perform network scanning and explain the meaning of the scanning results. ','What is a SQL injection attack? How to defend against this attack through code review and input validation? ','Describe how to use Cobalt Strike to conduct advanced persistent threat (APT) attacks. ','How to use Responder for network protocol deception and information collection? What is the implementation principle? ']

[0079] Step 3: Generate a template based on the command reply, and for the generated batch commands, cyclically call the GPT large model to generate corresponding command replies.

[0080] In this embodiment, a prompt template is generated by a preset command reply, and the GPT-4o business model is called cyclically to generate corresponding command replies for the generated batch of commands. A reference example of a command reply to generate a prompt template is as follows:

[0081] #01You are an expert in the field of cybersecurity and are good at answering questions (instructions) with professional knowledge.

[0082] #02 Your task is to generate an answer (output) based on the given question and combine the question and the answer into a question-answer pair (instruction-output).

[0083] #03 The generated answers should be accurate and concise, use academic language, use more of my information, and have richer content.

[0084] #04The number of words in the generated answer should be controlled within ***200 words***, but ***no less than 50 words***, and the generated answer must be complete, accurate, without omissions, and without redundancy.

[0085] #05The language used in the generated answer should be consistent with the language of the question.

[0086] #06 The following is an example of the answer generated for the question (instruction: "How to use SYN Flood to conduct DDoS attacks? What is the impact on the target network?"):

[0087] """

[0088] SYN Flood is a DDoS attack that exploits the three-way handshake process of the TCP protocol. The attacker sends a large number of forged SYN requests but does not complete the handshake process, causing the target server to run out of resources. The specific process is as follows: The attacker sends a large number of forged SYN packets to the target server, disguised as different IP addresses. The target server responds to the SYN-ACK packet and waits for the ACK confirmation. The attacker does not send an ACK packet, causing the server to maintain a large number of half-open connections (Half-Open Connection). This attack will cause the target server resources (such as CPU, memory, connection table) to be exhausted and unable to process legitimate user requests, resulting in service interruption or severe performance degradation. Defensive measures include SYN Cookies, increasing the connection queue, enabling firewall filtering, etc.

[0089] """

[0090] #07The theme name I provided is:

[0091] """

[0092] {{Theme Name}}

[0093] """

[0094] #08The questions that need to be answered are as follows:

[0095] """

[0096] {{Replace this with question (instruction)}}

[0097] """

[0098] Step 4: Convert the generated network security instructions and the response instruction replies into network security instruction data in a preset format.

[0099] In this embodiment, the generated instructions and their corresponding answers are converted into instruction data in a specific format. The specific format requirements are as follows:

[0100] {"subject":"***","instruction":"***","input":"***","output":"***"}

[0101] Among them, "subject" represents the network security topic; "instruction" corresponds to the generated instruction; "input" is a supplement to the instruction content and can be empty; "output" is the answer to the corresponding instruction.

[0102] In this embodiment, an example of a complete instruction data generated is as follows:

[0103] {"subject":"Attack Methods and Penetration Testing","instruction":"What is SQL Injection Attack? How to defend against this attack through code review and input validation?","input":"","output":"SQL injection attack is an attack method that manipulates database queries by inserting malicious SQL code into application input fields. Attackers can access, modify or delete data in the database, and even perform administrator operations in some cases.\n\nThe main methods for defending against SQL injection attacks include:\n\n1.**Code Review**: Review the code regularly to identify and fix potential SQL injection vulnerabilities. Focus on the part of dynamically generating SQL queries and ensure that safe coding practices are used.\n\n2.**Input Validation**: Strictly validate user input to ensure that the format, length and type of the input are as expected. You can use a whitelist strategy to only accept input that meets the standards.\n\n3.**Use parameterized queries**: Use Prepared Statements or stored procedures to separate user input from SQL commands to prevent malicious code execution. \n\n4. **Minimize database permissions**: Grant applications the lowest database permissions to limit their ability to operate on the database. \n\nThrough these measures, the risk of SQL injection attacks can be effectively reduced and the security and integrity of the database can be protected. "}

[0104] Step 5: Conduct a quality review on the network security instruction data, remove unqualified instruction data, regenerate instruction replies, and incrementally construct instruction data until the amount of network security instruction data for the subject reaches a set value;

[0105] In this embodiment, when conducting a quality review of the instruction data, the focus is on the instruction reply content, which mainly includes:

[0106] (1) Determine whether the response to the instruction is too short or too long. If so, it indicates failure;

[0107] (2) Determine whether the reply to the command matches the input command, if not, it is unqualified;

[0108] (3) Determine whether the reply to the command correctly answers the input command, if not, it is considered unqualified.

[0109] In actual applications, the quality review of instruction data can be conducted through automated software script judgment or expert manual review and annotation. For instruction data that fails the quality review, its instruction reply content needs to be eliminated, and the steps of generating instruction replies in step 3 and building network security instruction data in step 4 need to be repeated to incrementally build instruction data and complete the quality review until the amount of instruction data reaches the set value.

[0110] Step 6: Aggregate the cybersecurity instruction data of all topics to form a complete cybersecurity instruction fine-tuning dataset.

[0111] The generated instruction data corresponding to the currently selected topic is included in the resource pool, and then the next topic is selected. The process of steps 1 to 5 is repeated to batch generate high-quality instruction data for other topics in the field of network security until all topics are covered, thus forming a complete network security instruction fine-tuning dataset.

[0112] An embodiment of the present invention further proposes a system including a memory and a processor, wherein the memory stores a computer program corresponding to the efficient construction method for fine-tuning a network security instruction data set as described above, which can be loaded by the processor and executed.

[0113] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program includes a program code for executing the method shown in the flowchart.

[0114] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0115] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0117] As another aspect, the present application also provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the efficient construction method of the network security instruction fine-tuning data set described in the above embodiment.

[0118] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the efficient construction method of the network security instruction fine-tuning data set described in the above embodiment.

[0119] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0120] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0121] For those skilled in the art, the specific meanings of the above terms in the present invention can be understood in specific situations; the drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0122] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in the field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. An efficient method for constructing a network security instruction fine-tuning dataset, characterized in that: include: To classify the relevant knowledge in the field of cybersecurity by subject; For each topic, use the GPT large model to batch generate cybersecurity instructions; Generate a template for the command reply based on the generated batch of commands, and cyclically call the GPT large model to generate the corresponding command reply; Convert the generated network security instructions and the response instruction replies into network security instruction data in a preset format; Conduct a quality review of the cybersecurity instruction data, remove unqualified instruction data, and regenerate instruction replies, incrementally constructing instruction data until the amount of cybersecurity instruction data for the subject reaches a preset value; Aggregate the cybersecurity instruction data of all topics to form a complete cybersecurity instruction fine-tuning dataset.

2. The efficient construction method of the network security instruction fine-tuning dataset according to claim 1 is characterized in that: The use of the GPT large model to batch generate network security instructions specifically includes: Generate network security instructions using the GPT large model; Filter similar network security instructions; The process of generating and filtering is repeated until the required number of network security instructions are generated.

3. The efficient construction method of the network security instruction fine-tuning dataset according to claim 2 is characterized in that: The use of the GPT large model to generate network security instructions specifically includes: Determine the generated theme; Set the number of batch generation instructions; The GPT large model is used to generate templates according to instructions to complete the generation of network security instructions.

4. The efficient construction method of the network security instruction fine-tuning dataset according to claim 2 is characterized in that: The filtering similar network security instructions specifically include: Use an embedding model or a pre-trained language model to convert each generated instruction text into a vector representation; Use cosine similarity to calculate the similarity between instruction vectors; The similarities between all instruction vectors are traversed and compared with the preset similarity threshold. When the instruction similarity value is less than the preset similarity threshold, two instructions are retained; when the instruction similarity value is greater than the preset similarity threshold, only one instruction is retained.

5. The efficient construction method of the network security instruction fine-tuning dataset according to claim 3 is characterized in that: The process of repeatedly generating and filtering until a required number of network security instructions are generated specifically includes: After filtering similar instructions, the number of instructions needs to be supplemented, and the GPT large model is used to generate the difference instructions; then the newly generated instructions are mixed with the original instructions for similarity calculation, and instructions with too high similarity are eliminated. The cycle continues until the total number of instructions generated reaches the set value, and the similarity between each instruction is lower than the preset similarity threshold.

6. The efficient construction method of the network security instruction fine-tuning dataset according to claim 1 is characterized in that: The preset format includes a network security theme, a correspondingly generated instruction, a supplement to the instruction content, and an answer to the corresponding instruction.

7. The efficient construction method of the network security instruction fine-tuning dataset according to claim 1 is characterized in that: The network security instruction data is subject to quality review, specifically including: Determine whether the response to the command is too short or too long, if so, it means it is unqualified; Determine whether the reply to the command matches the input command, if not, it is unqualified; Determine whether the reply to the command correctly answers the input command, if not, it is unqualified.

8. A system, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executes a computer program corresponding to the efficient construction method of the network security instruction fine-tuning data set according to any one of claims 1 to 7.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: The program instructions, when executed by a processor, are used to implement a process corresponding to the method for efficiently constructing a network security instruction fine-tuning data set according to any one of claims 1 to 7.

Images