Access intention determination and training method and device, equipment and medium
By parsing the URL with a pre-trained large language model and determining its access intention, it solves the problem of difficulty in detecting randomly changing URLs in the prior art, and realizes accurate detection and recognition of malicious domain name URLs.
Patent Information
- Application Number
- CN202311112707.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-30
- Publication Date
- 2025-03-14
AI Technical Summary
The prior art is difficult to effectively detect randomly changing URLs and cannot cope with the precise detection requirements of URLs corresponding to malicious domain names.
By using large language models, especially pre-trained language generation models containing at least one billion parameters, the URL to be parsed, its access intention is determined, and the model is optimized through training methods to adapt to diverse and frequently changing URLs.
It realizes accurate identification and detection of diverse and frequently changing URLs, improves the integrity, comprehensiveness and accuracy of access intentions, and gets rid of the dependence on preset rules and technical experts.
Smart Images
Figure CN119622074A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security technology, and in particular to an access intention determination and training method, device, equipment and medium. Background Art
[0002] In the related art, the Uniform Resource Locator (URL) is usually parsed through preset rules or neural network models obtained through machine learning and deep learning to determine whether the URL comes from an attacker corresponding to a malicious domain name. However, the above method cannot meet the detection needs of randomly changing URLs. Summary of the invention
[0003] Based on the above problems, the embodiments of the present application provide a method, apparatus, device and medium for determining and training access intention.
[0004] The technical solution provided by the embodiment of the present application is as follows:
[0005] The present application provides a method for determining access intention, the method comprising:
[0006] Acquire data to be parsed; wherein the data to be parsed includes a uniform resource locator to be parsed;
[0007] The data to be parsed is parsed by a large language model to at least determine the access intention of the data to be parsed; wherein the large language model is a language generation model containing at least one billion parameters and is pre-trained using text data in a general field and data in a security field.
[0008] In some embodiments, the step of parsing the data to be parsed by using a large language model to at least determine the access intent of the data to be parsed includes:
[0009] Determining prompt data based on the data to be parsed;
[0010] The prompt data is processed by the large language model to obtain the access intention.
[0011] In some embodiments, the determining the prompt data based on the data to be parsed includes:
[0012] Get parsing configuration data;
[0013] Based on the parsing configuration data, the data to be parsed is configured and processed to obtain the prompt data.
[0014] In some embodiments, the method further comprises:
[0015] Based on the access intention, it is determined whether the uniform resource locator is of a malicious type.
[0016] In some embodiments, the large language model is deployed in the cloud; parsing the data to be parsed by using the large language model includes:
[0017] The data to be parsed is sent to the cloud to trigger the large language model to parse the data to be parsed.
[0018] The present application also provides a training method, which includes:
[0019] Acquire sample data; wherein the sample data includes uniform resource locators with multiple access intents;
[0020] An initial large language model is trained based on the sample data to obtain a large language model; wherein the large language model is used to parse the data to be parsed, and at least determine the access intent of the data to be parsed; the data to be parsed includes a uniform resource locator to be parsed; the large language model is a language generation model obtained by pre-training using text data in a general field and data in a security field, and contains at least one billion parameters.
[0021] In some embodiments, the training of the initial large language model based on the sample data to obtain the large language model includes:
[0022] Eliminating redundant data in the sample data to obtain first data;
[0023] The initial large language model is trained based on the first data and the access intention of the first data to obtain the large language model.
[0024] In some embodiments, removing redundant data from the sample data to obtain the first data includes:
[0025] Determining a matching degree between the mth uniform resource locator and the nth uniform resource locator in the sample data; wherein m and n are mutually different positive integers;
[0026] Based on the matching degree, at least part of the second data is removed from the sample data to obtain the first data; wherein the matching degree between the uniform resource locators in the second data is greater than or equal to a first threshold.
[0027] In some embodiments, removing redundant data from the sample data to obtain the first data includes:
[0028] Determining the completeness of the uniform resource locator in the sample data;
[0029] The first data is obtained by removing data whose completeness is less than or equal to a second threshold from the sample data.
[0030] In some embodiments, the training of the initial large language model based on the first data and the access intention of the first data to obtain the large language model includes:
[0031] Based on the first data, determine sample prompt data;
[0032] The initial large language model is trained based on the sample prompt data and the access intention of the first data to obtain the large language model.
[0033] The embodiment of the present application also provides a device for determining access intention, the device comprising:
[0034] A first acquisition module is used to acquire data to be parsed; wherein the data to be parsed includes a uniform resource locator to be parsed;
[0035] A determination module is used to parse the data to be parsed through a large language model to obtain the access intention of the data to be parsed; wherein the large language model is a language generation model containing at least one billion parameters obtained by pre-training using text data in the general field and data in the security field.
[0036] The present application also provides a training device, the device comprising:
[0037] A second acquisition module is used to acquire sample data; wherein the sample data includes uniform resource locators with multiple access intents;
[0038] A training module is used to train an initial large language model based on the sample data to obtain a large language model; wherein the large language model is used to parse the data to be parsed, and at least determine the access intent of the data to be parsed; the data to be parsed includes a uniform resource locator to be parsed; wherein the large language model is a language generation model obtained by pre-training using text data in the general field and data in the security field, and contains at least one billion parameters.
[0039] An embodiment of the present application also provides an electronic device, comprising a processor and a memory; wherein a computer program is stored in the memory; when the computer program is executed by the processor, it can implement any of the access intention determination methods described above, or any of the training methods described above.
[0040] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored; when the computer program is executed by a processor, it can implement any of the access intention determination methods described above, or any of the training methods described above.
[0041] The access intention determination method provided in the embodiment of the present application obtains the data to be parsed including the URL to be parsed, and then parses the data to be parsed through a large language model to at least determine the access intention of the data to be parsed. In this way, in the above process, with the help of the powerful semantic understanding ability of the large language model, it is possible to achieve accurate recognition of the data to be parsed, thereby improving the integrity, comprehensiveness and accuracy of the access intention; and, since the large language model is a language generation model containing at least one billion parameters obtained by pre-training using text data in the general field and data in the security field, therefore, with the help of the powerful understanding ability, reasoning processing ability and generalization ability of the large language model, it is also possible to achieve flexible and targeted recognition and processing of diverse and frequently changing URLs, thereby getting rid of the dependence on preset rules, features and security protection experience of technical experts, and thus meeting the accurate detection needs of URLs corresponding to frequently changing malicious domain names. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 A flowchart of a method for determining access intention provided in an embodiment of the present application;
[0043] Figure 2 A flowchart of a training method provided in an embodiment of the present application;
[0044] Figure 3 Another flowchart of the method for determining access intention provided in an embodiment of the present application;
[0045] Figure 4 A schematic diagram of the structure of an access intention determination device provided in an embodiment of the present application;
[0046] Figure 5 A schematic diagram of the structure of a training device provided in an embodiment of the present application;
[0047] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0048] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.
[0049] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0050] With the development of Internet technology, the number of malicious domain names is also increasing. URLs associated with malicious domain names pose a huge threat to network security. Traditional detection methods for URLs containing malicious domain names rely on rule matching and feature matching.
[0051] However, the rule matching method requires professional technicians to manually write screening or filtering rules based on their security defense experience, and the feature matching method is based on limited historical attack behavior features. Therefore, the above methods have a strong lag and cannot accurately detect URLs containing frequently changing malicious domain names.
[0052] Based on the above problems, the embodiments of the present application provide a method, apparatus, device and medium for determining and training access intention.
[0053] It should be noted that the access intention determination method provided in the embodiment of the present application can be implemented by a processor of an electronic device. The above-mentioned processor can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller (MCU), and a microprocessor.
[0054] In one implementation, the electronic device may be a physical device or a virtual machine device.
[0055] In one embodiment, the electronic device may be a computer device.
[0056] In one embodiment, the electronic device may be a personal computer or a server device.
[0057] Figure 1 A flow chart of a method for determining access intention provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method may include the following steps:
[0058] Step 101: Obtain data to be parsed.
[0059] The data to be parsed includes the URL to be parsed.
[0060] In one implementation, the data to be parsed may include URLs accessed by the electronic device in a historical stage, and may also include URLs to be accessed by the electronic device.
[0061] In one implementation, the data to be parsed may include at least one URL.
[0062] Step 102: Parse the data to be parsed using a large language model to at least determine the access intent of the data to be parsed.
[0063] Among them, the large language model is a language generation model that is pre-trained using text data from general fields and data from security fields and contains at least one billion parameters.
[0064] In one implementation, the large language model may include a Large Language Model (LLM) or a General Language Model (GLM).
[0065] LLM is a natural language processing model based on deep learning, which can learn the grammar and semantics of natural language, so as to generate human-readable text. The language model in LLM includes an artificial intelligence (AI) model used to process language, text or symbol system, which is used to discover the rules contained in text or data, and automatically generate content that conforms to these rules in combination with prompts.
[0066] Exemplarily, LLM is a language generation model based on the Transformer architecture, pre-trained using known text data, and containing more than one billion parameters; wherein the Transformer architecture is a neural network architecture based on the attention mechanism (Attention Mechanism) for processing sequence data, especially natural language data.
[0067] LLM can quickly and automatically process various natural language processing tasks, such as natural language generation, text classification, text summarization, machine translation, and speech recognition.
[0068] LLM can be trained on trillions of tokens and use public datasets to carry out the training process, thereby improving the semantic recognition ability of the LLM model without relying on proprietary and inaccessible datasets. Therefore, the high-performance LLM exceeds the Generative Pre-Trained Transformer (GPT-3) model (175B) on most benchmarks, while the model size is more than 10 times smaller.
[0069] GLM is based on bilingual training of a large number of identifiers, supplemented by supervised fine-tuning, feedback self-help, human feedback reinforcement learning and other technologies to align human intentions, and has the capabilities of question-answering, multi-round dialogue, code generation, etc. It has outstanding performance in various business scenarios such as logical reasoning, content creation, code generation and information extraction. Among them, by injecting knowledge and pre-training of code, GLM has reasoning ability; through pre-training of massive data, GLM has great potential for creation, so that it can generate code according to instructions and give code explanations; at the same time, through pre-training, GLM has strong language comprehension ability, which can deeply understand the logical relationship between text information and extract the required structured information from unstructured text information.
[0070] In one embodiment, the understanding and reasoning capabilities of the large language model may include the understanding and reasoning capabilities of URLs, and may also include its understanding and reasoning capabilities of security protection log data of electronic devices.
[0071] In one embodiment, the access intention may include the purpose of accessing the URL contained in the data to be parsed to the electronic device; exemplarily, the access intention may include the purpose of accessing the URL in the data to be parsed to the electronic device, to the data stored in the electronic device, and to at least one of other devices associated with the electronic device; exemplarily, the purpose of accessing the electronic device may include the purpose of attempting to obtain control of the electronic device, the purpose of accessing the data stored in the electronic device may include the purpose of attempting to obtain, change, edit or even delete the data stored in the electronic device, and the purpose of accessing other devices associated with the electronic device may include the purpose of attacking or manipulating data processing devices, data storage devices and authentication devices that have established communication connections with the electronic device.
[0072] In one implementation, the access intention may be obtained in any of the following ways:
[0073] The domain names contained in the data to be parsed are identified and parsed through a large language model to obtain the access intent.
[0074] The time period during which the data to be parsed accesses the electronic device and the domain name contained in the data to be parsed are identified and parsed through a large language model, thereby obtaining the access intention.
[0075] Through the large-scale language model analysis, the matching degree between the domain names contained in each URL contained in the data to be parsed and the historical malicious domain names is determined to determine whether the domain names corresponding to each URL in the data to be parsed come from the website or device corresponding to the malicious domain name, and the access intentions of the historical malicious domain names are integrated, and the integration results are determined as the access intentions.
[0076] In one embodiment, a large language model processes the data to be parsed and can also determine the risk level of the access intention corresponding to the data to be parsed; illustratively, the large language model can determine the risk level of the access intention based on at least one of the access intention, the data type targeted by the access intention, and the access frequency of the data to be parsed. For example, if the access frequency indicates that the frequency of the data to be parsed accessing the electronic device per unit time is greater than or equal to the frequency threshold, and the data type targeted by the access intention is data with a privacy level greater than the level threshold, then the access intention can be determined to be at a high risk level.
[0077] As can be seen from the above, the access intention determination method provided in the embodiment of the present application, after obtaining the data to be parsed including the URL to be parsed, parses the data to be parsed through a large language model, and at least determines the access intention of the data to be parsed. In this way, in the above process, with the help of the powerful semantic understanding ability of the large language model, it is possible to achieve accurate recognition of the data to be parsed, thereby improving the integrity, comprehensiveness and accuracy of the access intention; and, since the large language model is a language generation model containing at least one billion parameters obtained by pre-training using text data in the general field and data in the security field, therefore, with the help of the powerful understanding ability, reasoning processing ability and generalization ability of the large language model, it is also possible to achieve flexible and targeted recognition and processing of diverse and frequently changing URLs, thereby getting rid of the dependence on preset rules, features and the security protection experience of technical experts, and then meeting the accurate detection needs of URLs corresponding to frequently changing malicious domain names.
[0078] Based on the foregoing embodiments, in the access intention determination method provided in the embodiments of the present application, the data to be parsed is parsed by a large language model, and at least the access intention of the data to be parsed is determined, which can be achieved by the following steps:
[0079] Step A1: Determine prompt data based on the data to be parsed.
[0080] In one embodiment, the prompt data can be used to guide the large language model to perform the parsing degree and / or parsing direction of the data; exemplarily, the parsing degree may include whether the large language model performs associative parsing on the data to be parsed, for example, whether the large language model performs associative parsing on the data to be parsed based on the historical URL; exemplarily, the parsing direction may include how the large language model selects and parses at least part of the data to be parsed.
[0081] In one implementation, the prompt data may include prompt.
[0082] In one implementation, the prompt data may be determined in any of the following ways:
[0083] Determine the parsing guidance data, and determine the concatenation result of the parsing guidance data and the data to be parsed as prompt data; wherein the parsing guidance data can be used to guide the parsing direction of a large language model, and the parsing guidance data can be different depending on the URL in the data to be parsed.
[0084] Determine the parsing target data, and determine the combination result of the parsing target data and the data to be parsed as prompt data; wherein the parsing target data may include data such as the format and / or type of the expected large language model output data.
[0085] Step A2: parse and process the prompt data through a large language model to obtain the access intention.
[0086] In one implementation, the access intent may be obtained in the following manner:
[0087] Parsing guidance data is obtained from the prompt data, and based on the parsing guidance data, a large language model is guided to parse the data to be parsed in the prompt data to obtain a first parsing result, and then the first parsing result is determined as the access intention.
[0088] The parsing target data is obtained from the prompt data, and the data to be parsed is intercepted based on the parsing target data to obtain an interception result, and then the interception result is parsed through a large language model to obtain a second parsing result, and then the second parsing result is determined as the access intention.
[0089] From the above, it can be seen that the access intention determination method provided in the embodiment of the present application can improve the correlation between the prompt data and the data to be parsed by determining the prompt data based on the data to be parsed; and, obtaining the access intention by processing the prompt data with a large language model can not only improve the consistency between the access intention and the data to be parsed, but also improve the controllability of the large language model processing process, so that the access intention obtained in the above manner can meet the actual security protection needs.
[0090] Based on the foregoing embodiment, in the access intention determination method provided in the embodiment of the present application, the prompt data is determined based on the data to be parsed, which can be implemented by the following steps:
[0091] Step B1: Obtain parsing configuration data.
[0092] In one embodiment, the parsing configuration data may include additional data to be added to the data to be parsed; illustratively, the additional data may include at least one of parsing guidance data and data describing a parsing method for the data to be parsed.
[0093] In one implementation, the parsing configuration data may include a target format for directing the large language model to output data; illustratively, the target format may include a text format.
[0094] In one implementation, parsing the configuration data may include the length of the prompt data and data content included in at least one field of the prompt data.
[0095] In one implementation, different to-be-parsed data may correspond to different parsing configuration data.
[0096] Step B2: Based on the parsed configuration data, perform configuration processing on the data to be parsed to obtain prompt data.
[0097] In one implementation, the prompt data may be obtained by any of the following methods:
[0098] The additional data included in the parsed configuration data is integrated and configured with the data to be parsed, thereby obtaining prompt data.
[0099] According to the data content contained in at least one field contained in the parsing configuration data, the additional data contained in the parsing configuration parameters and the data to be parsed are integrated and processed to obtain prompt data.
[0100] As can be seen from the above, the access intention determination method provided by the embodiment of the present application, after obtaining the parsing configuration data, performs configuration processing on the data to be parsed based on the parsing configuration data to obtain prompt data. In this way, through the above operation, not only the prompt data is closely associated with the data to be parsed, but also targeted configuration processing of the data to be parsed can be achieved; and by adjusting the parsing configuration data, the flexibility and controllability of configuring the data to be parsed to obtain prompt data can also be improved.
[0101] Based on the foregoing embodiment, the access intention determination method provided in the embodiment of the present application may further include the following steps:
[0102] Determine whether the URL is malicious based on the access intent.
[0103] In one implementation, the malicious type may indicate that the URL in the data to be parsed is a malicious URL.
[0104] In one implementation, the non-malicious type may indicate that the URL in the data to be parsed is not a malicious URL.
[0105] In one implementation, whether a URL is malicious can be determined in the following manner:
[0106] The access intention is analyzed to determine the access purpose of the URL in the data to be parsed. Based on the access purpose, it is determined whether the URL is of a malicious type. For example, if the access intention indicates the purpose of attempting to gain control of the electronic device, the URL may be of a malicious type.
[0107] From the above, it can be seen that the access intention determination method provided in the embodiment of the present application can improve the accuracy of the URL type by determining whether the URL is a malicious type based on the access intent, because the access intent can more comprehensively display the operation purpose of the URL in the data to be parsed.
[0108] Based on the foregoing embodiments, in the access intention determination method provided in the embodiments of the present application, a large language model is deployed in the cloud.
[0109] In one implementation, at least one server device may be deployed in the cloud, that is, a large language model may be deployed in at least one server device; illustratively, the server device may be a virtual machine device or a physical machine device.
[0110] Accordingly, parsing the data to be parsed through a large language model can be achieved in the following ways:
[0111] Send the data to be parsed to the cloud to trigger a large language model to parse the data.
[0112] In one implementation, a communication connection may be established between the electronic device and the cloud, and the data to be parsed may be sent to the cloud through the communication connection so that the large language model deployed in the cloud can parse the data to be parsed.
[0113] From the above, it can be seen that in the access intention determination method provided in the embodiment of the present application, a large language model is deployed in the cloud, so that different types of terminal devices can access the large language model through the cloud; and, with the help of the powerful data processing capabilities of the cloud, after sending the data to be parsed to the cloud, the efficiency of the large language model in parsing the data to be parsed can be improved.
[0114] Based on the above embodiments, the present application also provides a training method. Figure 2 A flow chart of the training method provided in the embodiment of the present application is shown in FIG. Figure 2 As shown, the method may include the following steps:
[0115] Step 201: Obtain sample data.
[0116] The sample data includes URLs with various access intents.
[0117] In one embodiment, the sample data may include multiple URLs with multiple access intents; exemplarily, the multiple URLs may be associated with different network devices or network systems; exemplarily, the network device may include a terminal device; the network system may include a long-distance network system such as a metropolitan area network, and may also include a short-distance network system such as a WiFi network.
[0118] In one implementation, the multiple access intentions may include malicious access intentions or non-malicious access intentions.
[0119] In one embodiment, multiple access intentions can be divided according to the objects targeted by the URLs in the sample data. For example, if the first URL in the sample data targets sensitive data stored in the terminal device, the access intention of the first URL can be sensitive data access; if the second URL in the sample data targets other devices associated with the terminal device, the access intention of the second URL can be associated device access; wherein, sensitive data may include data associated with the device identity of the terminal device and the user identity of the terminal device, and may also include data created by the user of the terminal device that is unrelated to the above-mentioned device identity and user identity but has a confidentiality level greater than a preset level, such as project code developed by the user of the terminal device, process data written, or program planning data, etc.
[0120] Step 202: Train the initial large language model based on the sample data to obtain a large language model.
[0121] Among them, the large language model is used to parse the data to be parsed, at least to determine the access intention of the data to be parsed; the data to be parsed includes the URL to be parsed; the large language model is a language generation model that is pre-trained using text data in the general field and data in the security field and contains at least one billion parameters.
[0122] In one implementation, a large language model may be obtained by:
[0123] The sample data is input into the initial large language model, so that in the process of the initial large language model processing the sample data, it can identify, capture and track the association between the URL carried in the sample data and the access intention, and fine-tune the parameters of the initial large language model based on the above association, so that the large language model has the function of identifying and parsing the access intention of the URL covered by the sample data.
[0124] From the above, it can be seen that the training method provided in the embodiment of the present application, after obtaining sample data including URLs with multiple access intentions, obtains a large language model by training the initial large language model based on the sample data, so that the large language model can have the function of parsing and identifying the access intentions of the URLs in the sample data, thereby improving the large language model's parsing and identification accuracy for the access intentions of diverse URLs.
[0125] Based on the foregoing embodiment, in the training method provided in the embodiment of the present application, the initial large language model is trained based on the sample data to obtain the large language model, which can be achieved by the following steps:
[0126] Step C1: Eliminate redundant data in the sample data to obtain first data.
[0127] In one implementation, the redundant data may be at least one type of data that is predetermined.
[0128] In one implementation, the redundant data contained in different URLs may be different.
[0129] In one implementation, the redundant data may include spaces and / or line breaks contained in each URL of the sample data.
[0130] Step C2: Based on the first data and the access intention of the first data, an initial large language model is trained to obtain a large language model.
[0131] In some embodiments, a large language model may be obtained by:
[0132] The first data is input into an initial large language model to obtain a parsing result of the initial large language model on the first data, and then the semantic recognition parameters of the initial large language model are adjusted according to the matching degree between the parsing result and the access intent of the first data, until the matching degree between the parsing result and the access intent of the first data is greater than or equal to a matching threshold. At this time, the initial large language model after the semantic recognition parameters are adjusted can be determined as the large language model; wherein the semantic recognition parameters may include at least part of the parameters for parsing and identifying the access intent of the URL.
[0133] From the above, it can be seen that the training method provided in the embodiment of the present application obtains the first data by eliminating redundant data in the sample data, thereby reducing the redundancy of the first data; on this basis, the initial large language model is trained based on the first data and the access intention of the first data, which can improve the training efficiency; and, by conducting supervised training on the initial large language model based on the first data and the access intention of the first data, the parsing and recognition accuracy of the large language model can also be improved.
[0134] Based on the foregoing embodiment, in the training method provided in the embodiment of the present application, redundant data in the sample data is removed to obtain the first data, which can be obtained by the following steps:
[0135] Step D1: Determine the matching degree between the mth URL and the nth URL in the sample data.
[0136] Here, m and n are positive integers that are different from each other.
[0137] In one implementation, the degree of matching may represent the similarity or difference between the mth URL and the nth URL.
[0138] In one implementation, the matching degree may be obtained by any of the following methods:
[0139] The mth domain name and the nth domain name included in the mth URL and the nth URL are obtained respectively, a first matching degree between the mth domain name and the nth domain name is determined, and then the additional address data excluding the mth domain name and the nth domain name in the mth URL and the nth URL is obtained, and a second matching degree between the additional address data respectively included in the mth URL and the nth URL is determined, and then the first matching degree and the second matching degree are determined as the above matching degrees; wherein the additional address data may include address link data excluding the mth domain name and the nth domain name in the mth URL and the nth URL.
[0140] Obtain the separator data respectively contained in the mth URL and the nth URL, and then segment the mth URL and the nth URL based on the separator data to obtain the mth segmentation result and the nth segmentation result, and then perform character matching on the mth segmentation result and the nth segmentation result, and determine the result of the character matching as the degree of matching; wherein the above-mentioned separator data may include a slash or a backslash, and may also include ".", etc.
[0141] Step D2: based on the matching degree, remove at least part of the second data from the sample data to obtain the first data.
[0142] The matching degree between the URLs in the second data is greater than or equal to the first threshold.
[0143] In one implementation, at least part of the second data may include N-1 URLs included in the second data; wherein N may be an integer greater than or equal to 2, and N may represent the number of URLs included in the second data.
[0144] As can be seen from the above, in the training method provided in the embodiment of the present application, after determining the degree of match between any two URLs in the sample data, at least part of the data in the second data is removed from the sample data based on the degree of match, and the degree of match between the URLs in the second data is greater than or equal to the first threshold. In this way, through the above operation, the similarity and redundancy between the URLs in the first data can be reduced, thereby reducing the data volume of the first data.
[0145] Based on the foregoing embodiment, in the training method provided in the embodiment of the present application, removing redundant data in the sample data to obtain the first data can also be achieved by the following steps:
[0146] Step E1: Determine the completeness of the URL in the sample data.
[0147] In one embodiment, the completeness may indicate whether the URL includes a complete address of a website portal or a website page.
[0148] In one embodiment, the degree of completeness may be determined by:
[0149] Regular matching data is determined in advance, and then regular matching is performed on the URL in the sample data based on the regular matching data, and the degree of completeness is determined according to the result of the regular matching; wherein the regular matching data may include a preset domain name and a preset additional address; correspondingly, the degree of completeness may include whether the URL of the sample data completely contains the domain name and the additional address.
[0150] Step E2: Eliminate data whose completeness is less than or equal to the second threshold in the sample data to obtain the first data.
[0151] In one implementation, the data in the sample data whose completeness is less than or equal to the second threshold may include an invalid URL in the sample data.
[0152] As can be seen from the above, in the training method provided in the embodiment of the present application, after determining the completeness of the URL in the sample data, the data in the sample data whose completeness is less than or equal to the second threshold is removed to obtain the first data. In this way, through the above operation, invalid URLs in the sample data can be removed, thereby improving the validity of the URLs in the first data.
[0153] Based on the foregoing embodiment, in the training method provided in the embodiment of the present application, based on the first data and the access intention of the first data, the initial large language model is trained to obtain the large language model, which can be achieved by the following steps:
[0154] Step F1: Determine sample prompt data based on the first data.
[0155] In one implementation, the first data may be processed based on the method of obtaining the prompt data in the aforementioned embodiment to obtain sample prompt data.
[0156] Step F2: Based on the sample prompt data and the access intention of the first data, an initial large language model is trained to obtain a large language model.
[0157] In one implementation, the large language model may be obtained by any of the following methods:
[0158] Sample parsing guidance data is obtained from the sample prompt data, and based on the sample parsing guidance data, the initial large language model is guided to parse the first data in the prompt data to obtain a third parsing result, and then based on the matching relationship between the third parsing result and the access intent of the first data, the parameters used to parse and identify the URL access intent in the initial large language model are adjusted to obtain a large language model.
[0159] A sample interception parameter is obtained from the sample prompt data, and the first data is intercepted based on the sample interception parameter to obtain a sample interception result, and then the sample interception result is parsed through a large language model to obtain a fourth parsing result, and then based on the matching relationship between the fourth parsing result and the access intention of the first data, the parameters used for parsing and identifying the URL access intention in the initial large language model are adjusted to obtain a large language model.
[0160] From the above, it can be seen that in the training method provided in the embodiment of the present application, after the sample prompt data is determined based on the first data, the initial large language model is trained based on the sample prompt data and the access intention of the first data to obtain a large language model. In this way, through the sample prompt data, it is possible to carry out targeted and directional reinforcement and guidance during the training of the initial large language model, thereby improving the controllability of the initial large language model training process, and further improving the targetedness and accuracy of the large language model obtained by training in the above manner in URL recognition.
[0161] Figure 3 Another flowchart of the access intention determination method provided in the embodiment of the present application is shown in FIG. Figure 3 In this paper, the above process will be explained by taking the large language model LLM as an example. Figure 3 As shown, the process may include the following steps:
[0162] Step 301: Training process.
[0163] Exemplarily, the training process may implement a process of training an initial LLM to obtain an LLM.
[0164] Exemplarily, step 301 may be implemented by the following steps:
[0165] Step 3011, obtain sample data.
[0166] Step 3012: data loading.
[0167] Exemplarily, by executing a data loading operation, a parsing process for sample data may be initiated.
[0168] Step 3013: Eliminate noise.
[0169] Exemplarily, eliminating noise may include removing redundant data in the sample data to obtain first data; exemplarily, the redundant data may include at least part of the second data described in the aforementioned embodiment, and may also include data in the sample data whose completeness is less than or equal to a second threshold.
[0170] Step 3014: Data standardization.
[0171] Exemplarily, data standardization may include performing format conversion on the first data, such as converting uppercase letters in the URL of the first data into corresponding lowercase letters.
[0172] Step 3015: Data labeling.
[0173] Exemplarily, the access intent of the first data after data standardization may be annotated based on the access intent included in the sample data.
[0174] Step 3016: Initial LLM fine-tuning.
[0175] Exemplarily, at least part of the weight parameters of the initial LLM may be adjusted based on the first data after data normalization and the access intention of the first data, thereby obtaining the LLM.
[0176] Step 3017: Model storage.
[0177] Exemplarily, the LLM trained in the previous steps may be stored.
[0178] Step 302: Detection process.
[0179] Exemplarily, in the detection process, the real-time URL, that is, the data to be parsed, can be obtained, and the data to be parsed can be parsed through LLM to obtain the access intention.
[0180] Step 3021, obtain real-time data.
[0181] Exemplarily, the real-time data may include a URL detected in real time.
[0182] Exemplarily, the real-time data may correspond to a malicious domain name.
[0183] Malicious domain names are usually used by hackers or malware to carry out network attacks, fraud, phishing and other malicious activities. In actual applications, malicious domain names are often used to deceive users to induce them to click on links, download malware, and leak personal sensitive information to attackers. In addition, malicious domain names may disguise themselves as legitimate websites or emails to gain user trust and achieve the purpose of the attack. Therefore, in the actual web browsing process, you should try to reduce clicking on links or downloading attachments from unknown sources, and use security software and antivirus software to protect your devices and network.
[0184] Step 3022: Load the model for real-time detection.
[0185] Exemplarily, the LLM obtained through training in the preceding steps may be loaded into the operating space of the electronic device, and the LLM may be started to process the real-time data to obtain the access intention.
[0186] Step 3023, output the result.
[0187] Exemplarily, the access intention may be output in the form of voice, text, image, or video.
[0188] Exemplarily, the initial LLM obtained after fine-tuning, namely, the LLM, may also be deployed in the cloud, and a real-time detection service may be provided externally in the cloud.
[0189] Exemplarily, by detecting real-time data through LLM, the false alarm rate of URLs containing malicious domain names can be reduced and the detection rate of URLs containing malicious domain names can be improved; wherein the false alarm rate includes the ratio of the number of false alarm events detected to the number of all events detected, and the detection rate includes the ratio of the number of correctly predicted events to the total number of events.
[0190] From the above, it can be seen that the embodiment of the present application not only provides a complete training process for obtaining LLM from the initial LLM, but also provides how to process the real-time URL through LLM to obtain the access intention. Through the above operation, not only can the accuracy of parsing the real-time URL be improved, but also the parsing and processing requirements of rapidly changing malicious domain names or URLs can be met.
[0191] Based on the above embodiments, the present application also provides a device for determining access intention. Figure 4A schematic diagram of the structure of the access intention determination device provided in the embodiment of the present application, such as Figure 4 As shown, the device 4 may include:
[0192] The first acquisition module 401 is used to acquire data to be parsed; wherein the data to be parsed includes a URL to be parsed;
[0193] The determination module 402 is used to parse the data to be parsed through a large language model to obtain the access intent of the data to be parsed; wherein the large language model is a language generation model containing at least one billion parameters obtained by pre-training using text data in the general field and data in the security field.
[0194] In some embodiments, the determination module 402 is used to determine prompt data based on the data to be parsed; and process the prompt data through a large language model to obtain the access intention.
[0195] In some embodiments, the first acquisition module 401 is used to acquire parsing configuration data;
[0196] The access intention determination device also includes a first processing module, which is used to perform configuration processing on the data to be parsed based on the parsed configuration data to obtain prompt data.
[0197] In some embodiments, the determination module 402 is further used to determine whether the URL is of a malicious type based on the access intention.
[0198] In some embodiments, the large language model is deployed in the cloud; the above-mentioned device 4 may also include a sending module for sending the data to be parsed to the cloud to trigger the large language model to parse the data to be parsed.
[0199] The access intention determination device provided in the embodiment of the present application obtains the data to be parsed including the URL to be parsed, and then parses the data to be parsed through a large language model to at least determine the access intention of the data to be parsed. In this way, in the above process, with the help of the powerful semantic understanding ability of the large language model, it is possible to accurately identify the data to be parsed, thereby improving the integrity, comprehensiveness and accuracy of the access intention; and with the help of the powerful generalization ability corresponding to the understanding and reasoning processing ability in the large language model, it is also possible to achieve flexible and targeted recognition and processing of diverse and frequently changing URLs, and get rid of the dependence on preset rules, features and security protection experience of technical experts, so as to meet the accurate detection needs of URLs corresponding to frequently changing malicious domain names.
[0200] Based on the above embodiments, the present application also provides a training device. Figure 5 A schematic diagram of the structure of the training device provided in the embodiment of the present application, such as Figure 5As shown, the device 5 may include:
[0201] The second acquisition module 501 is used to acquire sample data; wherein the sample data includes URLs with multiple access intentions;
[0202] The training module 502 is used to train the initial large language model based on the sample data to obtain the large language model; wherein the large language model is used to parse the data to be parsed, at least to determine the access intent of the data to be parsed; the data to be parsed includes a URL with parsing; the large language model is a language generation model obtained by pre-training using text data in the general field and data in the security field, and contains at least one billion parameters.
[0203] In some embodiments, the training device 5 may further include a second processing module for removing redundant data from the sample data to obtain the first data;
[0204] The training module 502 is used to train the initial large language model based on the first data and the access intention of the first data to obtain a large language model.
[0205] In some embodiments, the second processing module is further used to determine the matching degree between the mth uniform resource locator and the nth uniform resource locator in the sample data; wherein m and n are positive integers that are different from each other;
[0206] The second processing module is further used to remove at least part of the second data from the sample data based on the matching degree to obtain the first data; wherein the matching degree between the uniform resource locators in the second data is greater than or equal to the first threshold.
[0207] In some embodiments, the second processing module is used to determine the completeness of the uniform resource locator in the sample data; and remove the data in the sample data whose completeness is less than or equal to the second threshold to obtain the first data.
[0208] In some embodiments, the second processing module is used to determine sample prompt data based on the first data;
[0209] The training module 502 is used to train the initial large language model based on the sample prompt data and the access intention of the first data to obtain a large language model.
[0210] The training device provided in the embodiment of the present application obtains sample data including URLs with multiple access intentions, and then obtains a large language model by training an initial large language model based on the sample data, so that the large language model can have the functions of identifying and parsing the access intentions of the URLs in the sample data, thereby improving the large language model's parsing and identification accuracy for the access intentions of diverse URLs.
[0211] Based on the above embodiments, the present application also provides an electronic device, Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 6 As shown, the electronic device 6 may include a processor 601 and a memory 602; wherein the memory 602 stores a computer program, and when the computer program is executed by the processor 601, it can implement any of the access intention determination methods or training methods described above.
[0212] Based on the foregoing embodiments, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor of an electronic device, it can implement any of the access intention determination methods or training methods described above.
[0213] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.
[0214] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.
[0215] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.
[0216] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.
[0217] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.
[0218] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.
[0219] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.
[0220] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.
[0221] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0222] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0223] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0224] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A method for determining access intention, characterized in that: The method comprises: Acquire data to be parsed; wherein the data to be parsed includes a uniform resource locator to be parsed; The data to be parsed is parsed by a large language model to at least determine the access intention of the data to be parsed; wherein the large language model is a language generation model containing at least one billion parameters and is pre-trained using text data in a general field and data in a security field.
2. The method according to claim 1, characterized in that The step of parsing the data to be parsed by using a large language model to at least determine the access intent of the data to be parsed includes: Determining prompt data based on the data to be parsed; The prompt data is processed by the large language model to obtain the access intention.
3. The method according to claim 2, characterized in that The step of determining prompt data based on the data to be parsed includes: Get parsing configuration data; Based on the parsing configuration data, the data to be parsed is configured and processed to obtain the prompt data.
4. The method according to claim 1, characterized in that: The method further comprises: Based on the access intention, it is determined whether the uniform resource locator is of a malicious type.
5. The method according to claim 1, characterized in that: The large language model is deployed in the cloud; The step of parsing the data to be parsed by using a large language model includes: The data to be parsed is sent to the cloud to trigger the large language model to parse the data to be parsed.
6. A training method, characterized in that: The method comprises: Acquire sample data; wherein the sample data includes uniform resource locators with multiple access intents; An initial large language model is trained based on the sample data to obtain a large language model; wherein the large language model is used to parse the data to be parsed, and at least determine the access intention of the data to be parsed; the data to be parsed includes a uniform resource locator to be parsed; the large language model is a language generation model obtained by pre-training using text data in a general field and data in a security field, and contains at least one billion parameters.
7. The method according to claim 6, characterized in that The training of the initial large language model based on the sample data to obtain the large language model includes: Eliminating redundant data in the sample data to obtain first data; The initial large language model is trained based on the first data and the access intention of the first data to obtain the large language model.
8. The method according to claim 7, characterized in that The removing redundant data from the sample data to obtain the first data includes: Determining a matching degree between the mth uniform resource locator and the nth uniform resource locator in the sample data; wherein m and n are mutually different positive integers; Based on the matching degree, at least part of the second data is removed from the sample data to obtain the first data; wherein the matching degree between the uniform resource locators in the second data is greater than or equal to a first threshold.
9. The method according to claim 7, characterized in that: The removing redundant data from the sample data to obtain the first data includes: Determining the completeness of the uniform resource locator in the sample data; The first data is obtained by removing data whose completeness is less than or equal to a second threshold from the sample data.
10. The method according to claim 7, characterized in that The training of the initial large language model based on the first data and the access intention of the first data to obtain the large language model includes: Based on the first data, determine sample prompt data; The initial large language model is trained based on the sample prompt data and the access intention of the first data to obtain the large language model.
11. A device for determining access intention, characterized in that: The device comprises: A first acquisition module is used to acquire data to be parsed; wherein the data to be parsed includes a uniform resource locator to be parsed; A determination module is used to parse the data to be parsed through a large language model to obtain the access intention of the data to be parsed; wherein the large language model is a language generation model containing at least one billion parameters obtained by pre-training using text data in the general field and data in the security field.
12. A training device, characterized in that: The device comprises: A second acquisition module is used to acquire sample data; wherein the sample data includes uniform resource locators with multiple access intents; A training module is used to train an initial large language model based on the sample data to obtain a large language model; wherein the large language model is used to parse the data to be parsed, and at least determine the access intent of the data to be parsed; the data to be parsed includes a uniform resource locator to be parsed; the large language model is a language generation model obtained by pre-training using text data in the general field and data in the security field, and contains at least one billion parameters.
13. An electronic device, characterized in that: The device includes a processor and a memory; wherein a computer program is stored in the memory; when the computer program is executed by the processor, it can implement the access intention determination method as described in any one of claims 1 to 5, or the training method as described in any one of claims 6 to 10.
14. A computer-readable storage medium, characterized in that: The storage medium stores a computer program; when the computer program is executed by a processor, it can implement the access intention determination method as described in any one of claims 1 to 5, or the training method as described in any one of claims 6 to 10.