Network attack threat trapping method, device and equipment

Abstract

The invention relates to a network attack threat trapping method, device and equipment. Preprocessing and prompt engineering processing can be sequentially carried out on a Web intrusion request; judging whether the processed Web intrusion request is an attack request or not by utilizing a detection model, and if yes, generating an attack type result; constructing an attack knowledge base corresponding to different network attack types according to existing website resources and related data; according to an attack type result and attack content of the Web intrusion request, similar data are retrieved from the attack knowledge base; and splicing the attack content and the similar data, and inputting the spliced attack content and similar data into a first large language model to obtain a simulation response aiming at the attack content. According to the technical scheme, the type of the attack request can be accurately identified by using the detection model, and the detection capability is improved. And the obtained simulation response can perform more complex and flexible interaction with an attacker, so that attack behaviors can be better cheated and trapped.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device and equipment for trapping network attack threats. Background Art

[0002] In today's highly complex network security environment, traditional passive defense methods have gradually failed to meet the growing security needs. With the continuous evolution and diversification of attack methods, network security experts urgently need to adopt more proactive defense strategies. In this context, honeypot technology came into being and became an important proactive defense tool. Honeypot technology simulates real or virtual systems and services, deliberately exposing some vulnerabilities and weaknesses to lure attackers to attack. Once an attacker enters the honeypot environment, all of his behaviors and operations will be recorded and analyzed, providing the security team with valuable attack intelligence and threat information.

[0003] However, traditional honeypot technology has some limitations. First, traditional honeypots are static and can be easily discovered by advanced attackers. Second, although high-interaction honeypots can provide a more realistic simulation environment, they also have the risk of unknown vulnerabilities and may be used by attackers as a springboard to attack real systems. In addition, honeypot technology relies on prior knowledge and rule bases, and there are problems of missed reports and false positives for unknown attacks.

[0004] Among the existing technical solutions, for example, the invention with publication number CN118555136A discloses a feedback-based self-learning honeypot deployment method and system, which can improve the threat capture rate of the system, as well as the flexibility and adaptability in the face of threats, and avoid the waste of hardware resources caused by the full deployment of honeypots, but lacks the ability to identify and classify network attack types. The invention with publication number CN117834228A discloses a reinforcement learning honeypot construction method and device based on the BERT model. The invention mainly returns the optimal strategy by learning the existing resource strategy, lacks the ability to simulate and generate intelligent responses after the entrapment attack, and maintains the interactive behavior with the attacker.

[0005] Therefore, existing honeypot tools lack the ability to identify the type of network attacks, the identification ability is not accurate enough, the error rate is high, and they are heavily dependent on existing rules. The defense against network attacks is still in a passive mode. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a network attack threat trapping method, device and equipment to solve the problem that the recognition ability of honeypot tools in the prior art is not accurate enough and is heavily dependent on existing rules.

[0007] According to a first aspect of an embodiment of the present invention, a network attack threat trapping method is provided, comprising:

[0008] When an original Web intrusion request is received, the Web intrusion request is sequentially pre-processed and prompted for engineering processing;

[0009] Use the pre-trained detection model to determine whether the processed Web intrusion request is an attack request. If so, generate an attack type result;

[0010] Based on the existing website resources and related data, an attack knowledge base corresponding to different types of network attacks is constructed;

[0011] Retrieving similar data from the attack knowledge base according to the attack type result and attack content of the Web intrusion request;

[0012] After the attack content and the similar data are spliced, they are input into the first language model to obtain a simulated response to the attack content.

[0013] Preferably, the training process of the detection model includes:

[0014] Acquire a training data set, and perform prompt engineering processing on each data in the training data set;

[0015] For each data, the expected output of the data is obtained, and the expected output is spliced ​​with the processed data to construct fine-tuning data;

[0016] Based on the fine-tuning data, the second largest language model is fine-tuned using LoRA technology to obtain a large language model for a specific field as a detection model.

[0017] Preferably, the prompt engineering processing includes:

[0018] Obtaining a prompt word consisting of a description part, an instruction part, an input part, and an output part, wherein the description part guides the model to construct a task according to the instruction part, and generates a response as an output part based on the task and the input part;

[0019] The instruction part includes a task prompt and an answer prompt; the task prompt guides the model to detect whether the URL in the input part contains an attack and obtain the attack type; the answer prompt guides the model to generate a response in a preset format.

[0020] Preferably, an attack knowledge base corresponding to different network attack types is constructed based on existing website resources and related data, including:

[0021] Organize existing website resources and related data to build knowledge base files corresponding to different types of network attacks;

[0022] Convert the data format in the knowledge base file into text format and use the text segmentation tool to segment each text;

[0023] Convert the segmented text into numerical vectors, and store all numerical vectors into a vector database;

[0024] An index of a numerical vector in a vector database is constructed, and an attack knowledge base is constructed based on the index and the vector database.

[0025] Preferably, according to the attack type result and attack content of the Web intrusion request, similar data is retrieved from the attack knowledge base, including:

[0026] Convert the attack type result and attack content of the Web intrusion request into a numerical vector;

[0027] In the vector space of the vector database, searching is performed according to the index to calculate the cosine similarity or Euclidean distance of the intrusion request numerical vector;

[0028] The numerical vectors of the first K texts that are most similar to the numerical vector of the intrusion request are obtained according to the cosine similarity or Euclidean distance matching.

[0029] Preferably, splicing the attack content and the similar data comprises:

[0030] The texts corresponding to the numerical vectors of the first K matched texts are used as the context of the attack content for text concatenation to obtain the input of the first language model.

[0031] Preferably, the network attack threat trapping method further includes:

[0032] Store the original web intrusion request and the generated simulated response into the history record;

[0033] The training data set is updated according to the data stored in the historical records, and the detection model is retrained using the updated training data set.

[0034] Preferably, the network attack threat trapping method further includes:

[0035] If the pre-trained detection model is used to determine that the processed Web intrusion request is a non-attack request, a normal response is returned.

[0036] According to a second aspect of an embodiment of the present invention, a network attack threat trapping device is provided, comprising:

[0037] The intrusion request acquisition module is used to perform pre-processing and prompt engineering processing on the Web intrusion request in sequence when receiving the original Web intrusion request;

[0038] The network attack detection module uses the pre-trained detection model to determine whether the processed Web intrusion request is an attack. If so, it generates an attack type result;

[0039] The attack knowledge base module is used to construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data; retrieve similar data from the attack knowledge base based on the attack type result and attack content of the Web intrusion request;

[0040] The threat trapping response module is used to splice the attack content and the similar data and input them into the first language model to obtain a simulated response to the attack content.

[0041] According to a third aspect of an embodiment of the present invention, a network attack threat trapping device is provided, including:

[0042] A main controller, and a memory connected to the main controller;

[0043] a memory in which program instructions are stored;

[0044] The main controller is used to execute program instructions stored in the memory to perform any of the above methods.

[0045] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0046] It can be understood that the technical solution shown in the present invention can perform pre-processing and prompt engineering processing on Web intrusion requests in sequence; use the detection model to determine whether the processed Web intrusion request is an attack request, and if so, generate an attack type result; construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data; retrieve similar data from the attack knowledge base based on the attack type result and attack content of the Web intrusion request; splice the attack content and the similar data, and input them into the first language model to obtain a simulated response to the attack content. The technical solution shown in the present invention can use the detection model to accurately identify the type of attack request, thereby improving the detection capability. The obtained simulated response can interact with the attacker in a more complex and flexible manner, thereby better deceiving the attack behavior and trapping it.

[0047] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0049] Figure 1 is a schematic diagram of steps of a network attack threat trapping method according to an exemplary embodiment;

[0050] Figure 2 It is a flowchart of a network attack threat trapping method according to an exemplary embodiment;

[0051] Figure 3 is a schematic diagram of a detection model training process and a workflow according to an exemplary embodiment;

[0052] Figure 4 is a schematic diagram of model fine-tuning according to an exemplary embodiment;

[0053] Figure 5 The figure is a schematic diagram of a threat trapping response process according to an exemplary embodiment. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0055] In one embodiment, Figure 1 is a schematic diagram of a method for trapping network attack threats according to an exemplary embodiment. Figure 1 , providing a network attack threat trapping method, including:

[0056] Step S11: when an original Web intrusion request is received, the Web intrusion request is sequentially pre-processed and prompted for engineering processing;

[0057] Step S12: using the pre-trained detection model to determine whether the processed Web intrusion request is an attack request, and if so, generating an attack type result;

[0058] Step S13: construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data;

[0059] Step S14: Retrieve similar data from the attack knowledge base according to the attack type result and attack content of the Web intrusion request;

[0060] Step S15: After splicing the attack content and the similar data, input them into the first language model to obtain a simulated response to the attack content.

[0061] It can be understood that the technical solution shown in the present invention can perform pre-processing and prompt engineering processing on Web intrusion requests in sequence; use the detection model to determine whether the processed Web intrusion request is an attack request, and if so, generate an attack type result; construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data; retrieve similar data from the attack knowledge base based on the attack type result and attack content of the Web intrusion request; splice the attack content and the similar data, and input them into the first language model to obtain a simulated response to the attack content. The technical solution shown in the present invention can use the detection model to accurately identify the type of attack request, thereby improving the detection capability. The obtained simulated response can interact with the attacker in a more complex and flexible manner, thereby better deceiving the attack behavior and trapping it.

[0062] In practice, see Figure 2 , specifically includes two stages, namely the detection stage and the threat trapping and response stage.

[0063] Before the detection phase, the original Web intrusion request needs to be preprocessed and processed. After the processing is completed, the detection phase is executed to detect whether the Web intrusion request is an attack request. If it is an attack request, the attack category of the Web intrusion request is also detected. If the pre-trained detection model is used to determine that the processed Web intrusion request is not an attack request, a normal response is returned.

[0064] In the detection phase, this embodiment uses the detection model to detect Web intrusion requests. Figure 3 The training process and working reasoning process of the detection model are shown. It should be noted that the training process of the detection model includes:

[0065] A training data set is obtained, and each data in the training data set is processed by prompt engineering; for each data, the expected output of the data is obtained, and the expected output is spliced ​​with the processed data to construct fine-tuning data; based on the fine-tuning data, the second largest language model is fine-tuned using the LoRA technology to obtain a large language model for a specific field as a detection model.

[0066] In specific practice, to train the detection model, first obtain a data set. Preferably, after preprocessing the data set, split the data set into a training data set and a test data set. The training data set can be used to train the detection model, and the test data set can be used to test the detection model.

[0067] After the training data set is obtained, each data in the training data set needs to be processed by prompt engineering.

[0068] It should be noted that the prompt engineering processing includes:

[0069] Obtain a prompt word consisting of a description part, an instruction part, an input part and an output part, wherein the description part guides the model to construct a task according to the instruction part, and to generate a response as the output part based on the task and the input part; the instruction part includes a task prompt and an answer prompt; the task prompt guides the model to detect whether the URL of the input part contains an attack and derive the attack type; the answer prompt guides the model to generate a response in a preset format.

[0070] In specific practice, this example refers to OpenAI's prompt design document and Stanford Alpaca fine-tuning document, and the same prompt should be the same during fine-tuning and reasoning. The prompt consists of four parts: description, instruction, input, and output. The description part guides the model to build tasks according to the instructions, and generates responses as outputs based on the tasks and inputs.

[0071] The instruction is the core of the entire prompt. This embodiment analyzes a large number of attack samples and divides the instructions into task prompts and answer prompts. The task prompt guides the model to pay attention to the URL of the input part first and detect whether it contains SQL injection attacks, XSS attacks, command line attacks and other modes. The answer prompt guides the model to select "Yes" or "No" as the answer. When the answer is YES, the classification results "This is a SQL injection attack (Yes. This is a type of SQLinjection attack)" or "This is a XSS cross-site scripting attack (Yes. This is a type of XSSattack)" or "This is a command line attack (Yes. This is a type of Command Injection)" are returned together. The input part is the URL sample to be detected. The output part marks the end of the prompt and guides the model to generate a response.

[0072] When training the model, it is necessary to fine-tune the instructions for the training data after the prompt engineering process. However, when the detection model is working inference, since the detection model is required to make judgments, there is no need to fine-tune the instructions.

[0073] When fine-tuning instructions, this embodiment selects a suitable large language model base such as Llama and chatGLM, and uses the LoRA method for fine-tuning.

[0074] First, the expected output is concatenated with the processed data to construct fine-tuned data. In this embodiment, the fine-tuned expected output of the network attack sample is specified as Yes, and the classification result "This is a SQL injection attack" or "This is an XSS cross-site scripting attack" or "This is a command line attack" is returned; the fine-tuned expected output of the non-network attack sample is No.

[0075] Then, the model is fine-tuned using LoRA technology based on the fine-tuning data, such as Figure 4 As shown in the figure, LoRA technology freezes the weight parameters of the large language model during the fine-tuning process, adds additional network layers in the bypass, and only changes the parameters of these newly added network layers. Finally, the output of the large language model is summed with the output of the additional network layer to obtain the final output. The formula is as follows:

[0076] W=W 0 +αBA

[0077] Among them, W 0 is the pre-trained weight matrix, which is frozen during training and does not receive gradient updates; B and A contain trainable parameters, initialized to random Gaussian distribution and zero, respectively; α represents the scaling factor that controls the update strength.

[0078] The results show that the effect of fine-tuning is similar to that of full fine-tuning, thus obtaining a large language model for a specific field.

[0079] After obtaining the attack type result, enter the threat trapping response phase, see Figure 5 .

[0080] Step S13 constructs an attack knowledge base, which is a prerequisite for the threat trapping response phase.

[0081] It should be noted that the attack knowledge base corresponding to different types of network attacks is constructed based on existing website resources and related data, including:

[0082] The existing website resources and related data are sorted out to construct knowledge base files corresponding to different types of network attacks.

[0083] Convert the data in the knowledge base file into text format, and use text segmentation tools to segment each text. For example, use text segmentation tools such as RecursiveCharacterTextSplitter and HTMLHeaderTextSplitter to segment the text into Documents for subsequent processing.

[0084] Convert the segmented text into numerical vectors and store all numerical vectors in a vector database. In practice, the segmented text can be converted into numerical vectors through embedding algorithms (such as TF-IDF, word2vec, BERT, etc.). These vectors are stored in a vector database to form the main body of the knowledge base.

[0085] An index of the numerical vector in the vector database is constructed, and an attack knowledge base is constructed based on the index and the vector database. In specific practice, an index is constructed by Faiss (Facebook AI Similarity Search) to perform fast similarity search.

[0086] It should be noted that after the attack knowledge base is built, a threat trapping response can be performed on the attack. According to the attack type result and attack content of the Web intrusion request, similar data is retrieved from the attack knowledge base, including:

[0087] Convert the attack type results and attack content of the Web intrusion request into a numerical vector. The same embedding method as text vectorization can be used to convert the attack type results and attack content into a numerical vector.

[0088] In the vector space of the vector database, a search is performed according to the index to calculate the cosine similarity or Euclidean distance of the intrusion request numerical vector.

[0089] The numerical vectors of the first K texts that are most similar to the numerical vector of the intrusion request are obtained according to the cosine similarity or Euclidean distance matching.

[0090] It should be noted that the attack content and the similar data are spliced ​​together, including:

[0091] The texts corresponding to the numerical vectors of the first K matched texts are used as the context of the attack content for text concatenation to obtain the input of the first language model.

[0092] Using the first language model (such as GPT, Llama, etc.), a simulated response to the attack content is obtained, and the simulated response is fed back to the requester to achieve the effect of threat trapping and response.

[0093] It should be noted that the network attack threat trapping method also includes:

[0094] The original Web intrusion request and the generated simulated response are stored in a historical record; the training data set is updated according to the data stored in the historical record, and the detection model is retrained using the updated training data set.

[0095] It is understandable that the network attack information and the generated simulation responses are collected into historical records for the purpose of analyzing information such as attack links and expanding the further fine-tuning of attack identification models in subsequent network attack identification modules to enhance the capabilities in vertical fields.

[0096] This embodiment fine-tunes the large language model and uses the LoRA fine-tuning method to train the general large language model into a special vertical field large language model. It can accurately identify SQL injections, XSS cross-site scripting attacks, and command line attacks, etc., further improving the detection capability.

[0097] As a highly interactive intelligent threat trapping tool, this embodiment has the ability to simulate the behavior of real systems more accurately, can learn and understand the context and meaning of natural language, has more advanced intelligent interaction capabilities, can understand and generate code or virtual resources, and interact with attackers in a more complex and flexible manner, so as to better deceive attack behaviors and trap them. It can dynamically adjust and respond according to the attacker's behavior and context, thereby improving the effectiveness of countering attacks. Through large model simulation responses, it misleads and confuses attackers and increases the timeliness of attacks.

[0098] According to a second aspect of an embodiment of the present invention, a network attack threat trapping device is provided, comprising:

[0099] The intrusion request acquisition module is used to perform pre-processing and prompt engineering processing on the Web intrusion request in sequence when receiving the original Web intrusion request;

[0100] The network attack detection module uses the pre-trained detection model to determine whether the processed Web intrusion request is an attack. If so, it generates an attack type result;

[0101] The attack knowledge base module is used to construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data; retrieve similar data from the attack knowledge base based on the attack type result and attack content of the Web intrusion request;

[0102] The threat trapping response module is used to splice the attack content and the similar data and input them into the first language model to obtain a simulated response to the attack content.

[0103] It can be understood that the technical solution shown in this embodiment can pre-process and prompt engineering processing of Web intrusion requests in sequence through the intrusion request acquisition module; the network attack detection module uses the detection model to determine whether the processed Web intrusion request is an attack request, and if so, the attack type result is generated; the attack knowledge base module is used to construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data; according to the attack type result and attack content of the Web intrusion request, similar data is retrieved from the attack knowledge base; the threat trapping response module splices the attack content and the similar data, and inputs them into the first language model to obtain a simulated response to the attack content. The technical solution shown in the present invention can accurately identify the type of attack request using the detection model, thereby improving the detection capability. The obtained simulated response can interact with the attacker in a more complex and flexible manner, thereby better deceiving the attack behavior and trapping it.

[0104] According to a third aspect of an embodiment of the present invention, a network attack threat trapping device is provided, including:

[0105] A main controller, and a memory connected to the main controller;

[0106] a memory in which program instructions are stored;

[0107] The main controller is used to execute program instructions stored in the memory to perform any of the above methods.

[0108] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0109] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0110] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0111] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0112] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0113] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0114] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0115] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0116] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A network attack threat trapping method, characterized in that: include: When an original Web intrusion request is received, the Web intrusion request is sequentially pre-processed and prompted for engineering processing; Use the pre-trained detection model to determine whether the processed Web intrusion request is an attack request. If so, generate an attack type result; Based on the existing website resources and related data, an attack knowledge base corresponding to different types of network attacks is constructed; Retrieving similar data from the attack knowledge base according to the attack type result and attack content of the Web intrusion request; After the attack content and the similar data are spliced, they are input into the first language model to obtain a simulated response to the attack content.

2. The network attack threat trapping method according to claim 1, characterized in that: The training process of the detection model includes: Acquire a training data set, and perform prompt engineering processing on each data in the training data set; For each data, the expected output of the data is obtained, and the expected output is spliced ​​with the processed data to construct fine-tuning data; Based on the fine-tuning data, the second largest language model is fine-tuned using LoRA technology to obtain a large language model for a specific field as a detection model.

3. The network attack threat trapping method according to claim 1 or 2, characterized in that: The prompt engineering processing includes: Obtaining a prompt word consisting of a description part, an instruction part, an input part, and an output part, wherein the description part guides the model to construct a task according to the instruction part, and generates a response as an output part based on the task and the input part; The instruction part includes a task prompt and an answer prompt; the task prompt guides the model to detect whether the URL in the input part contains an attack and obtain the attack type; the answer prompt guides the model to generate a response in a preset format.

4. The network attack threat trapping method according to claim 1, characterized in that: Based on the existing website resources and related data, an attack knowledge base corresponding to different types of network attacks is constructed, including: Organize existing website resources and related data to build knowledge base files corresponding to different types of network attacks; Convert the data format in the knowledge base file into text format and use the text segmentation tool to segment each text; Convert the segmented text into numerical vectors, and store all numerical vectors into a vector database; An index of a numerical vector in a vector database is constructed, and an attack knowledge base is constructed based on the index and the vector database.

5. The network attack threat trapping method according to claim 4, characterized in that: According to the attack type result and attack content of the Web intrusion request, similar data is retrieved from the attack knowledge base, including: Convert the attack type result and attack content of the Web intrusion request into a numerical vector; In the vector space of the vector database, searching is performed according to the index to calculate the cosine similarity or Euclidean distance of the intrusion request numerical vector; The numerical vectors of the first K texts that are most similar to the numerical vector of the intrusion request are obtained according to the cosine similarity or Euclidean distance matching.

6. The network attack threat trapping method according to claim 5 is characterized in that: Splicing the attack content and the similar data, including: The texts corresponding to the numerical vectors of the first K matched texts are used as the context of the attack content for text concatenation to obtain the input of the first language model.

7. The network attack threat trapping method according to claim 2, characterized in that: Also includes: Store the original web intrusion request and the generated simulated response into the history record; The training data set is updated according to the data stored in the historical records, and the detection model is retrained using the updated training data set.

8. The network attack threat trapping method according to claim 1, characterized in that: Also includes: If the pre-trained detection model is used to determine that the processed Web intrusion request is a non-attack request, a normal response is returned.

9. A network attack threat trapping device, characterized in that: include: The intrusion request acquisition module is used to perform pre-processing and prompt engineering processing on the Web intrusion request in sequence when receiving the original Web intrusion request; The network attack detection module uses the pre-trained detection model to determine whether the processed Web intrusion request is an attack. If so, it generates an attack type result; The attack knowledge base module is used to construct an attack knowledge base corresponding to different network attack types based on existing website resources and related data; retrieve similar data from the attack knowledge base based on the attack type result and attack content of the Web intrusion request; The threat trapping response module is used to splice the attack content and the similar data and input them into the first language model to obtain a simulated response to the attack content.

10. A network attack threat trapping device, characterized in that: include: A main controller, and a memory connected to the main controller; a memory in which program instructions are stored; The main controller is used to execute program instructions stored in the memory and perform the method according to any one of claims 1 to 8.

Images