LLM power monitoring system-based security policy identification analysis method and system

Abstract

The invention discloses a security policy identification analysis method and system based on an LLM power monitoring system. The method comprises the following steps: respectively and automatically acquiring network routing information and security policy information of SSH and Web type equipment by using an intelligent acquisition strategy through an SSH interface and a Web interface; performing association analysis on all network routing information and security policy information by using a graph data method; and based on the association analysis result of the routing information and the security policy information, automatically generating a network security policy optimization suggestion by using an LLM model. According to the scheme, the LLM model is used for identifying the security policy, and the optimization suggestion is generated in combination with the network information.

Description

Technical Field

[0001] The present invention belongs to the field of information security equipment strategy inspection and optimization of electric power monitoring systems, and in particular relates to a security strategy identification and analysis method and system based on an LLM electric power monitoring system. Background Art

[0002] The security policy of the power monitoring system directly affects the network security assessment results. The existing network management is for all switching devices in the network. Information security equipment is generally managed as a single machine, or the same brand of equipment is managed uniformly, and it is impossible to analyze and optimize the security policy association of network equipment and security equipment of different brands. Summary of the invention

[0003] In order to solve the deficiencies in the prior art, the present invention provides a security policy identification and analysis method and system based on an LLM power monitoring system to solve the technical problem of security policy association analysis between network devices and security devices.

[0004] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0005] The present invention first discloses a security strategy identification and analysis method based on an LLM power monitoring system, the method comprising the following steps:

[0006] Step 1: Use intelligent collection strategies to automatically collect network routing information and security policy information of SSH and Web type devices through the SSH interface and Web interface respectively;

[0007] Step 2: Use graph data methods to perform correlation analysis on all network routing information and security policy information;

[0008] Step 3: Based on the correlation analysis results of the routing information and security policy information, the LLM model is used to automatically generate network security policy optimization suggestions.

[0009] The present invention further includes the following preferred embodiments:

[0010] The method of using the intelligent collection strategy to automatically collect network routing information and security policy information of SSH and Web type devices respectively further includes:

[0011] Use the SSH command AI generation model to send SSH collection commands to SSH interface routing devices or network security devices to obtain security device policy command data sets;

[0012] A web crawler program is generated by using a web crawler program model, and network routing and security policy information of a web interface routing device or a network security device is collected based on the web crawler program to obtain a web device identification data set.

[0013] The obtaining of the web device identification data set further comprises:

[0014] Perform multi-level deep semantic mining on the input text information, use the multi-head attention mechanism to extract multi-level text semantic information, and input each input text T into multiple self-attention mechanisms:

[0015]

[0016] Where Q = K = V, and has the same features as the input text T; Q is the query, K is the key, and V is the value;

[0017] The semantic information of multiple attention mechanisms is integrated, and the semantic feature information integrating multiple layers of context information is obtained through multi-layer feature extraction and integration;

[0018] Identification is achieved by aligning routing information and security policy information through semantic feature information.

[0019] The method of automatically generating network security strategy optimization suggestions using the LLM model further includes:

[0020] Load the policy data file, read the policy data, segment the policy data, and vectorize the policy data and the question respectively; match the k policies that are most similar to the question vector in the policy vector, use the matched k policies as context, add them to the output together with the question, submit them to the LLM model to generate answers, and use the LLM model to automatically generate optimization suggestions for network security policies.

[0021] The present invention also discloses a security policy identification and analysis system based on an LLM power monitoring system using the aforementioned security policy identification and analysis method based on an LLM power monitoring system, comprising:

[0022] Intelligent collection module, used to automatically collect network routing information and security policy information of SSH and Web type devices through SSH interface and Web interface respectively using intelligent collection strategy;

[0023] The correlation analysis module is used to perform correlation analysis on all network routing information and security policy information using graph data methods;

[0024] The policy optimization module is used to automatically generate network security policy optimization suggestions based on the correlation analysis results of the routing information and the security policy information using the LLM model.

[0025] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0026] The storage medium is used to store instructions;

[0027] The processor is used to operate according to the instructions to execute the steps of the aforementioned security policy identification and analysis method based on the LLM power monitoring system.

[0028] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the aforementioned security strategy identification and analysis method based on the LLM power monitoring system are implemented.

[0029] The beneficial effect of the present invention lies in that, compared with the prior art, the present invention provides a security policy identification and analysis method and system based on the LLM power monitoring system, which intelligently manages various models of network routing devices or network security devices through two communication methods; based on routing information, intelligently analyzes and classifies routing and security policies, and generates policy optimization suggestions based on LLM. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of the intelligent collection strategy in the present invention.

[0031] Figure 2 It is a schematic diagram of the multi-head attention model in the present invention.

[0032] Figure 3 It is a comprehensive information graph in the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0034] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0035] In view of the shortcomings of the prior art, the present invention proposes a security policy identification and analysis method and system based on the LLM power monitoring system, which uses an automatic crawler program to automatically collect information from networks of different brands; obtains information security policies on information security devices, and conducts a joint analysis of network topology information and security policies; uses a large language model (LLM) recognition and classification model to identify and classify relevant policies in different devices, and combines the routing topology information collected by network devices to analyze the policies and provide optimization suggestions.

[0036] The security strategy identification and analysis method based on the LLM power monitoring system disclosed in the present invention comprises the following steps:

[0037] Step 1: Use intelligent collection strategies to automatically collect network routing information and security policy information of SSH and Web devices through the SSH interface and Web interface respectively.

[0038] See also Figure 1 , using intelligent collection strategies to automatically collect network routing and security policy information of SSH and Web devices. The specific method is to manage multiple models of network routing devices or network security devices through two communication methods.

[0039] Use SSH commands to send SSH collection commands to SSH interface routing devices or network security devices to obtain security device policy command data sets. SSH commands are generated using a BERT-based generative language model. The model uses a public BERT model and can automatically query the device manual and generate setting commands after learning device command samples.

[0040] A web crawler is generated using a web crawler model, and the web crawler collects network routing and security policy information of a web interface routing device or a network security device based on the web crawler to obtain a web device identification data set. The items crawled by the web crawler are generated by an AI model. The AI ​​model is generated based on a BERT language model. After learning from the device web sample, it can automatically query the manual of the device and generate a list of crawled items.

[0041] The BERT-based language model is to perform multi-level deep semantic mining on the input text information to extract more fine-grained information about the policy semantic configuration topic, thereby realizing policy information recognition and generation. Figure 2 As shown in the figure, with multi-head attention as the benchmark, the multi-head attention mechanism works together to extract multiple levels of text semantic information. For each input text T, that is, the text description in the device manual, the text is input into multiple self-attention mechanisms, and the formula is:

[0042]

[0043] Q is the query, K is the key, and V is the value. They are all parameters derived from the same text input matrix and linear transformation. Among them, Q = K = V, and they are the same as the input text T features. Then the semantic information of multiple attention mechanisms is fused, and through multi-layer feature extraction and integration, the final semantic feature information that integrates multi-layer context information is obtained. Then the routing information and security policy information are aligned through the semantic feature information to achieve recognition.

[0044] Step 2: Use graph data methods to perform correlation analysis on all network routing information and security policy information.

[0045] Based on the collected routing information and security policy information, generate Figure 3 The comprehensive information graph shown in the figure. All routing information and security policy information are mapped into graph data, and the correlation between each routing connection relationship and security policy is compared to form an analysis conclusion. Each node in the figure is a server, network device or network security device in the power monitoring system. The relationship between nodes is the data flow data in the power monitoring system, which is also the embodiment of routing strategy and security strategy. Therefore, using the network communication data flow relationship in the power monitoring system to train LLM enables LLM to have strategy planning capabilities.

[0046] Step 3: Based on the correlation between the routing information and the security policy information, the LLM model is used to automatically generate network security policy optimization suggestions.

[0047] First, load the policy data file collected in step 1, read the policy data, segment the policy data, and vectorize the policy data. Match the k policies with the most similar vectors in the policy vector, and submit the matched k policies to the LLM model as a new round of input. After LLM generates a preliminary policy-theory relationship solution, it will be verified and the LLM solver will be used to detect errors in the solution. The detection results are returned to LLM in the form of feedback, indicating whether the problem in the solution includes policy routing conflicts or invalidity. The LLM module generates four different types of feedback:

[0048] Conflict hint: Tells LLM at which nodes the path intersects with the routing policy.

[0049] Alternative hints: Provide LLM with suggestions for nodes or alternative routes that the policy can safely traverse.

[0050] Correct routing hint: Confirm which parts of the path generated by LLM are valid, and support the model to continue exploring based on these in the next round of answers.

[0051] This process is repeated for multiple rounds until LLM finds the correct solution or exceeds the predetermined number of iterations.

[0052] The beneficial effect of the present invention lies in that, compared with the prior art, the present invention provides a security policy identification and analysis method and system based on the LLM power monitoring system, which intelligently manages various models of network routing devices or network security devices through two communication methods; based on routing information, intelligently analyzes and classifies routing and security policies, and generates policy optimization suggestions based on LLM.

[0053] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a security policy identification and analysis system based on an LLM power monitoring system based on the aforementioned security policy identification and analysis method based on an LLM power monitoring system, comprising:

[0054] Intelligent collection module, used to automatically collect network routing information and security policy information of SSH and Web type devices through SSH interface and Web interface respectively using intelligent collection strategy;

[0055] The correlation analysis module is used to perform correlation analysis on all network routing information and security policy information using graph data methods;

[0056] The policy optimization module is used to automatically generate network security policy optimization suggestions based on the correlation analysis results of the routing information and the security policy information using the LLM model.

[0057] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned security policy identification and analysis method based on the LLM power monitoring system. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned security policy identification and analysis method based on the LLM power monitoring system.

[0058] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0059] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0060] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, executed as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A security strategy identification and analysis method based on LLM power monitoring system, characterized in that: The following steps are involved: Step 1: Use intelligent collection strategies to automatically collect network routing information and security policy information of SSH and Web type devices through the SSH interface and Web interface respectively; Step 2: Use graph data methods to perform correlation analysis on all network routing information and security policy information; Step 3: Based on the correlation analysis results of the routing information and security policy information, the LLM model is used to automatically generate network security policy optimization suggestions.

2. The security strategy identification and analysis method based on the LLM power monitoring system according to claim 1 is characterized in that: The method of using the intelligent collection strategy to automatically collect network routing information and security policy information of SSH and Web type devices respectively further includes: Use the SSH command AI generation model to send SSH collection commands to SSH interface routing devices or network security devices to obtain security device policy command data sets; A web crawler program is generated by using a web crawler program model, and network routing and security policy information of a web interface routing device or a network security device is collected based on the web crawler program to obtain a web device identification data set.

3. The security strategy identification and analysis method based on the LLM power monitoring system according to claim 2 is characterized in that: The obtaining of the web device identification data set further comprises: Perform multi-level deep semantic mining on the input text information, use the multi-head attention mechanism to extract multi-level text semantic information, and input each input text T into multiple self-attention mechanisms: Where Q = K = V, and has the same features as the input text T; Q is the query, K is the key, and V is the value; The semantic information of multiple attention mechanisms is integrated, and the semantic feature information integrating multiple layers of context information is obtained through multi-layer feature extraction and integration; Identification is achieved by aligning routing information and security policy information through semantic feature information.

4. The security strategy identification and analysis method based on the LLM power monitoring system according to claim 3 is characterized in that: The method of automatically generating network security strategy optimization suggestions using the LLM model further includes: Load the policy data file, read the policy data, segment the policy data, and vectorize the policy data and the question respectively; match the k policies that are most similar to the question vector in the policy vector, use the matched k policies as context, add them to the output together with the question, submit them to the LLM model to generate answers, and use the LLM model to automatically generate optimization suggestions for network security policies.

5. A security strategy identification and analysis system based on LLM power monitoring system, characterized in that: include: Intelligent collection module, used to automatically collect network routing information and security policy information of SSH and Web type devices through SSH interface and Web interface respectively using intelligent collection strategy; The correlation analysis module is used to perform correlation analysis on all network routing information and security policy information using graph data methods; The policy optimization module is used to automatically generate network security policy optimization suggestions based on the correlation analysis results of the routing information and the security policy information using the LLM model.

6. The security strategy identification and analysis system based on the LLM power monitoring system according to claim 5 is characterized in that: The intelligent acquisition module is further used for: Use the SSH command AI generation model to send SSH collection commands to SSH interface routing devices or network security devices to obtain security device policy command data sets; A web crawler program is generated by using a web crawler program model, and network routing and security policy information of a web interface routing device or a network security device is collected based on the web crawler program to obtain a web device identification data set.

7. The security strategy identification and analysis system based on the LLM power monitoring system according to claim 6 is characterized in that: The intelligent acquisition module is further used for: Perform multi-level deep semantic mining on the input text information, use the multi-head attention mechanism to extract multi-level text semantic information, and input each input text T into multiple self-attention mechanisms: Where Q = K = V, and has the same features as the input text T; Q is the query, K is the key, and V is the value; The semantic information of multiple attention mechanisms is integrated, and the semantic feature information integrating multiple layers of context information is obtained through multi-layer feature extraction and integration; Identification is achieved by aligning routing information and security policy information through semantic feature information.

8. The security strategy identification and analysis system based on the LLM power monitoring system according to claim 7 is characterized in that: The strategy optimization module is further used to: Load the policy data file, read the policy data, segment the policy data, and vectorize the policy data and the question respectively; match the k policies that are most similar to the question vector in the policy vector, use the matched k policies as context, add them to the output together with the question, submit them to the LLM model to generate answers, and use the LLM model to automatically generate optimization suggestions for network security policies.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instruction to execute the steps of the security policy identification and analysis method based on the LLM power monitoring system according to any one of claims 1-4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the security strategy identification and analysis method based on the LLM power monitoring system described in any one of claims 1 to 4 are implemented.

Images