Universal method and system for identifying attack success through large model

Abstract

The invention discloses a universal method and system for identifying attack success through a large model, and belongs to the field of network security. Calling a corresponding attack success identification strategy from a strategy library according to the alarm information, and adding all log types in a log library into a corresponding cue word template to obtain a preliminary cue word; inputting the preliminary cue word into the large model to obtain a required log type; optimizing the preliminary cue word according to the log content data to obtain an intermediate cue word; inputting the intermediate cue word into the large model to obtain the intermediate cue word; retrieving a log library according to the detection statement to obtain a retrieval result, and optimizing the intermediate cue word according to the retrieval result to obtain a final cue word; and inputting the final cue word into the large model to obtain an attack success identification result. The attack success identification strategy suitable for the attack traffic is adjusted through the strategy library, the cue word is dynamically generated through the large model and the log library, the large model judges whether the attack is successful or not according to the cue word, the adaptation degree is wide, and the efficiency is high.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a general method and system for identifying successful attacks through a large model. Background Art

[0002] In the field of network traffic security detection, security products such as NTA (NetFlow Traffic Analyzer) can already detect a variety of attacks and generate a large number of security alerts. However, among various attack methods, how to identify threatening successful attack events that need to be focused on is still the main challenge facing current technology.

[0003] Traditional methods usually perform attack detection by writing specific rules. For example, some rules can detect specific features of JNDI (Java Naming and Directory Interface) attacks, such as external malicious domain names, and extract domain names through regular expressions, and query DNS (Domain Name System) resolution logs to confirm whether the attack is successful. However, this method has many shortcomings. First, the writing and adaptation of rules is cumbersome and time-consuming, especially in complex attack scenarios such as Java command execution, it is difficult to cover all possible variations. Secondly, it is necessary to sort out the attack scenarios one by one and develop corresponding rules. The development workload is huge, and it is difficult to enumerate all attack scenarios even if a lot of resources are invested.

[0004] Therefore, there is an urgent need for a universal technology to effectively identify the risk of successful attacks in order to break through the limitations of existing technologies. Summary of the invention

[0005] The present application provides a general method and system for identifying successful attacks through a large model, which can solve the technical problems in the prior art of narrow application scope of successful attack identification rules and low efficiency of successful attack identification.

[0006] In a first aspect, an embodiment of the present application provides a general method for identifying successful attacks through a large model, characterized in that the method comprises:

[0007] Pre-configure the policy library and log library. The policy library contains multiple attack success identification policies. Each attack success identification policy includes a prompt word template for the corresponding attack traffic.

[0008] After detecting attack traffic, the security device issues an alarm and stores the original log of the attack traffic in the log library;

[0009] According to the alarm information, the corresponding attack success identification strategy is retrieved from the strategy library, and all log types in the log library are added to the corresponding prompt word template to obtain the preliminary prompt word;

[0010] Input the preliminary prompt words into the large model to obtain the required log type;

[0011] Extract log content data from the required log type, optimize the preliminary prompt words according to the log content data, and obtain the intermediate prompt words;

[0012] Input the intermediate prompt words into the large model to obtain the detection sentence;

[0013] Search the log library according to the detection sentence to obtain the search results, and optimize the intermediate prompt words according to the search results to obtain the final prompt words;

[0014] The final prompt word is input into the large model to obtain the successful attack recognition result.

[0015] In conjunction with the first aspect, in one implementation, the configuration strategy library specifically includes the following steps:

[0016] Corresponding multiple attack success identification strategies are pre-configured for multiple security product types and / or security devices to form a strategy library, and the same security product type includes multiple security devices.

[0017] In conjunction with the first aspect, in one implementation, the configuration strategy library specifically includes the following steps:

[0018] Corresponding multiple attack success identification strategies are configured in advance for multiple attack types and / or attack categories to form a strategy library, and the same attack type includes multiple attack categories.

[0019] In combination with the first aspect, in one implementation, the types of attack traffic include network attacks, abnormal logins, and viruses and Trojans.

[0020] In combination with the first aspect, in one implementation, the prompt word template includes warning information and analysis ideas.

[0021] In combination with the first aspect, in one implementation, the log content data includes a field name, field sample data, and a field description.

[0022] In combination with the first aspect, in one implementation, after the intermediate prompt word is input into the large model, the large model obtains the intermediate prompt word according to the alarm information, analysis ideas, and log content data.

[0023] In a second aspect, an embodiment of the present application provides a general system for identifying successful attacks through a large model, the system comprising:

[0024] A pre-configuration module, which is used to pre-configure a policy library and a log library, wherein the policy library includes multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic;

[0025] A data processing module is used to control the security device to issue an alarm message and store the original log of the attack traffic into a log library after detecting the attack traffic;

[0026] The attack identification module is used to retrieve the corresponding attack success identification strategy from the strategy library according to the alarm information, and add all log types in the log library to the corresponding prompt word template to obtain preliminary prompt words; input the preliminary prompt words into the large model to obtain the required log type; extract log content data from the required log type, optimize the preliminary prompt words according to the log content data, and obtain intermediate prompt words; input the intermediate prompt words into the large model to obtain intermediate prompt words; search the log library according to the detection statement to obtain the search result, optimize the intermediate prompt words according to the search result to obtain the final prompt word; input the final prompt word into the large model to obtain the attack success identification result.

[0027] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:

[0028] Pre-configure multiple attack success identification strategies for multiple attack traffic. After detecting the attack traffic, the security device calls the corresponding attack success identification strategy and stores the original log of the attack traffic in the log library. The attack success identification strategy contains a prompt word template for successful attack identification for the corresponding attack traffic. The prompt word template is optimized by combining the large model and the original log in the log library to dynamically generate a method for capturing analysis data. That is, through multiple optimizations, preliminary prompt words, intermediate prompt words, and final prompt words are obtained in turn. The large model determines whether the attack is successful based on the final prompt word. This solution has a wide adaptability and high efficiency for successful attack identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flowchart of an embodiment of a general method for identifying successful attacks through a large model in this application;

[0030] Figure 2 This is a schematic diagram of a specific embodiment of the general method for identifying successful attacks through a large model in this application;

[0031] Figure 3 This is a functional module diagram of an embodiment of a general system for identifying successful attacks through a large model in the present application. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0033] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0034] In a first aspect, embodiments of the present application provide a general method for identifying successful attacks through a large model.

[0035] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of an embodiment of a general method for identifying successful attacks through a large model in this application. Figure 1 As shown in the figure, the general methods for identifying successful attacks through large models include:

[0036] Step S1, pre-configure a policy library and a log library, the policy library contains multiple attack success identification policies, each attack success identification policy includes a prompt word template for the corresponding attack traffic;

[0037] Step S2: After detecting the attack traffic, the security device issues an alarm and stores the original log of the attack traffic in the log library;

[0038] Step S3: retrieve the corresponding attack success identification strategy from the strategy library according to the alarm information, and add all log types in the log library to the corresponding prompt word template to obtain a preliminary prompt word;

[0039] Step S4, input the preliminary prompt words into the large model to obtain the required log type;

[0040] Step S5, extracting log content data from the required log type, optimizing the preliminary prompt words according to the log content data, and obtaining the intermediate prompt words;

[0041] Step S6, inputting the intermediate prompt word into the large model to obtain the intermediate prompt word;

[0042] Step S7, searching the log library according to the detection sentence to obtain the search results, optimizing the intermediate prompt words according to the search results to obtain the final prompt words;

[0043] Step S8: input the final prompt word into the large model to obtain a successful attack recognition result.

[0044] In this embodiment, multiple attack success identification strategies for multiple attack flows are pre-configured. After detecting the attack flow, the security device calls the corresponding attack success identification strategy and stores the original log of the attack flow in the log library. The attack success identification strategy includes a prompt word template for successful attack identification for the corresponding attack flow. The prompt word template is optimized in combination with the large model and the original log in the log library to dynamically generate a method for capturing analysis data, that is, preliminary prompt words, intermediate prompt words, and final prompt words are obtained in turn through multiple optimizations. The large model determines whether the attack is successful based on the final prompt word. This solution has a wide adaptability to attack success identification and high efficiency.

[0045] In a specific embodiment, the attack traffic includes network attacks, abnormal logins, viruses, Trojans, etc.

[0046] The log types of the original log of the attack traffic include HTTP (Hypertext Transfer Protocol), DNS (Domain Name System) commands, TCP (Transmission Control Protocol) sessions, process chains, and command lines.

[0047] The log library stores the original logs of all attack traffic over a period of time.

[0048] Security devices include firewalls, NTA, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), WAF (Web Application Firewall), and host security, etc. The same security device can detect at least one type of attack.

[0049] Furthermore, in one embodiment, the configuration of the pre-configured policy library specifically includes the following steps:

[0050] Corresponding multiple attack success identification strategies are pre-configured for multiple security product types and / or security devices to form a strategy library, and the same security product type includes multiple security devices.

[0051] In this embodiment, when configuring the attack success identification strategy, it can be configured according to the security product type, that is, a certain type of security product type is applicable to one attack success identification strategy. Accordingly, all security devices under this type of security product type will call up the attack success identification strategy corresponding to the security product type when any attack traffic is detected, and perform subsequent identification operations according to the prompt word template in the attack success identification strategy. That is, all security devices of the same type of security product type use the same attack success identification method, thereby improving the coverage of a single attack success identification strategy and reducing the difficulty of configuring the attack success identification strategy.

[0052] When configuring a successful attack identification strategy, you can also configure it according to the security device, that is, a certain security device adapts to a successful attack identification strategy. Accordingly, when this security device detects any type of attack traffic, it calls up the successful attack identification strategy corresponding to the security product type, and performs subsequent identification operations based on the prompt word template in the successful attack identification strategy. That is, the same security device uses the same successful attack identification method, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy.

[0053] The coverage of the attack success identification policy configured according to the security product type is greater than the coverage of the attack success policy configured according to the security device. However, the policy accuracy of the attack success identification policy configured according to the security product type is less than the policy accuracy of the attack success policy configured according to the security device. How to configure the security attack policy should be flexibly adjusted according to actual needs.

[0054] Furthermore, in one embodiment, the configuration of the pre-configured policy library specifically includes the following steps:

[0055] Corresponding multiple attack success identification strategies are configured in advance for multiple attack types and / or attack categories to form a strategy library, and the same attack type includes multiple attack categories.

[0056] In this embodiment, when configuring the attack success identification strategy, it can be configured according to the attack type, that is, a certain type of attack is applicable to a successful attack identification strategy. Accordingly, all security devices that can detect this type of attack will call the successful attack identification strategy corresponding to the attack type when detecting the attack traffic of this type, and perform subsequent identification operations according to the prompt word template in the successful attack identification strategy. That is, all security devices that can detect the same type of attack use the same successful attack identification method when detecting a specific type of attack traffic, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy. Exemplarily, the attack type can be a network attack, abnormal login, or virus Trojan, etc., and the webshell upload event is a type of attack under the network attack.

[0057] When configuring a successful attack identification strategy, you can also configure it according to the type of attack, that is, a certain type of attack adapts to a successful attack identification strategy. Accordingly, all security devices that can detect this type of attack will call up the successful attack identification strategy corresponding to the attack type when detecting this type of attack traffic, and perform subsequent identification operations based on the prompt word template in the successful attack identification strategy. That is, all security devices that can detect the same type of attack use the same successful attack identification method when detecting a specific type of attack traffic, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy.

[0058] The coverage of the attack success identification policy configured based on attack type is greater than that of the attack success policy configured based on attack type. However, the policy accuracy of the attack success identification policy configured based on attack type is less than that of the attack success policy configured based on attack type. How to configure the security attack policy can be flexibly adjusted according to actual needs.

[0059] Furthermore, in one embodiment, multiple corresponding attack success identification strategies may be configured in combination with security product types, security devices, attack types, and attack categories.

[0060] Furthermore, in one embodiment, the prompt word template includes warning information and analysis ideas.

[0061] The log content data includes field name, field sample data, and field description.

[0062] After the intermediate prompt word is input into the large model, the large model obtains the intermediate prompt word according to the alarm information, analysis ideas, and log content data.

[0063] In this embodiment, refer to Figure 2 , Figure 2This is a schematic diagram of a specific embodiment of a general method for identifying successful attacks through a large model in this application. Taking the webshell upload event collected by NTA as an example, NTA issues an alarm message after detecting the attack traffic of the webshell upload event. At the same time, the original log of the webshell upload event is stored in the log library. According to the alarm message, the corresponding attack success identification strategy is retrieved from the pre-configured policy library, and the strategy includes a prompt word template that can be used to identify whether the webshell upload event is a successful attack. The log types of the alarm message and all the original logs in the log library are added to the prompt word template to obtain a preliminary prompt word. The preliminary prompt word is input into the large model, and the large model combines the preliminary prompt word to filter out the log type required to identify whether the webshell upload event is a successful attack from all log types, that is, the log associated with the attack traffic. Extract the log content data from the required log type, and optimize the preliminary prompt word according to the log content data to obtain the intermediate prompt word. The intermediate prompt word is input into the large model, and the large model combines the intermediate prompt word to obtain the detection statement. The log library is searched according to the detection statement to obtain the search results. For example, if the field content included in the query statement is retrieved, the subsequent large model considers the attack successful based on the search results. If the field content included in the query statement is not retrieved, the subsequent large model considers the attack unsuccessful based on the search results.

[0064] Specifically, NTA collects suspected webshell upload events and issues an alarm and records the alarm log:

[0065] {

[0066] "alert_id":"A20231028001",

[0067] "timestamp":"2023-10-28T10:15:00Z",

[0068] "source_ip":"192.168.1.100",

[0069] "destination_ip":"10.0.0.5",

[0070] "destination_port":80,

[0071] "alert_type":"Webshell Upload Attempt",

[0072] "request_uri":" / upload.php",

[0073] "http_status":200

[0074] }

[0075] At the same time, the original traffic of related visits is also recorded and collected by the http original log table.

[0076] The attack success identification strategies in the strategy library are divided into detailed strategies and catch-all strategies. According to major categories such as alarm devices and / or alarm sources (the same alarm source contains multiple alarm devices), default catch-all strategies are created. For example, a large model is used to determine the alarm type. If the alarm type is a network attack type alarm, the attack success identification strategy and prompt word template of the network attack type are used. Similarly, a default prompt word template is constructed to ensure that all alarms can be analyzed by the large model.

[0077] Since the catch-all strategy is relatively rough and can be adapted to all scenarios, but the guidance for analysis is not detailed enough, for example, for the alarm of webshell upload mentioned above, we can create detailed strategies for specific alarm names or clear types (the same alarm type contains multiple alarm names). When the detailed strategy is used to standardize the idea of ​​the big model to successfully judge the alarm of webshell upload event, the network layer analyzes whether there is subsequent access traffic to the webshell address and whether it is already communicating with the webshell if there is access traffic, to determine whether the webshell upload is successful.

[0078] In the policy library, the policy will allow the big model to analyze which logs are needed for analysis based on the alarm content. At this time, the log type list of the log library will be provided to the big model as context through preliminary prompt words, allowing the big model to make independent decisions to select the required original logs. After confirmation, the field details of the corresponding log type, field sample data, and description will be further unified into the overall analysis strategy prompt words through the prompt word template, that is, through the intermediate prompt words. The big model analyzes how to query the original log based on the alarm content, analysis ideas, and data conditions to determine whether the alarm is a successful attack event. At this time, the query statement generated based on the associated data type is obtained. For example:

[0079] SELECT *

[0080] FROM http_raw_traffic_logs

[0081] WHERE destination_ip='10.0.0.5'

[0082] AND timestamp>='2023-10-28T10:15:00Z'

[0083] AND request_uri LIKE' / uploads.php%'

[0084] The generated query statements are automatically scheduled for execution to complete the query of the original logs, for example: [

[0086] {"timestamp":"2023-10-28T10:17:00Z","source_ip":"192.168.1.100","destination_ip":"10.0.0.5","req uest_uri":" / uploads / shell.php?cmd=whoami","http_status":200,"response_content_base64":"cm9vdA==""} ]

[0088] Based on the query results, the final prompt words are fed back to the big model. The big model can make a comprehensive analysis and judge whether the attack is successful and the reasons for the judgment based on the alarm content and the query log results.

[0089] For example:

[0090] According to the above query results, the big model found that the attacker visited / uploads / shell.php after uploading and tried to execute the command. The command execution result was cm9vdA== which was decoded to root, indicating that the Webshell was uploaded successfully and the whoami command was executed.

[0091] It should be noted that for complex events, large models may require querying multiple categories or multiple logs until the analysis is completed or the number of iterations we pre-determined is reached. The default limit allows a maximum of 3 iterations to avoid performance consumption due to excessive iterations.

[0092] In summary, the analysis of whether a security incident is a successful attack is very complex. The traditional rule-based judgment method cannot adapt to various complex alarms and requires a lot of manpower. Through this patent, large model technology can be used in combination with a strategy library of professional judgment experience to analyze the methods and data required for successful attack judgment and actively obtain further data to support the analysis, and finally accurately give a method to determine whether the attack is successful. This method has good adaptability, and through the strategy library, it can quickly expand or fine-tune its capabilities.

[0093] On the second aspect, the embodiments of the present application also provide a general system for identifying successful attacks through a large model.

[0094] In one embodiment, referring to Figure 3 , Figure 3This is a functional module diagram of an embodiment of a general system for identifying successful attacks through a large model in this application. Figure 3 As shown in the figure, the general system for identifying successful attacks through large models includes:

[0095] A pre-configuration module 1 is used to pre-configure a policy library and a log library, wherein the policy library includes a plurality of attack success identification policies, and each attack success identification policy includes a prompt word template for corresponding attack traffic;

[0096] Data processing module 2, which is used to control the security device to issue an alarm message and store the original log of the attack traffic into the log library after detecting the attack traffic;

[0097] The attack identification module 3 is used to retrieve the corresponding attack success identification strategy from the strategy library according to the alarm information, and add all log types in the log library to the corresponding prompt word template to obtain preliminary prompt words; input the preliminary prompt words into the large model to obtain the required log type; extract the log content data from the required log type, optimize the preliminary prompt words according to the log content data, and obtain the intermediate prompt words; input the intermediate prompt words into the large model to obtain the intermediate prompt words; search the log library according to the detection statement to obtain the search result, optimize the intermediate prompt words according to the search result to obtain the final prompt words; input the final prompt words into the large model to obtain the attack success identification result.

[0098] In this embodiment, multiple attack success identification strategies for multiple attack flows are pre-configured. After detecting the attack flow, the security device calls the corresponding attack success identification strategy and stores the original log of the attack flow in the log library. The attack success identification strategy includes a prompt word template for successful attack identification for the corresponding attack flow. The prompt word template is optimized in combination with the large model and the original log in the log library to dynamically generate a method for capturing analysis data, that is, preliminary prompt words, intermediate prompt words, and final prompt words are obtained in turn through multiple optimizations. The large model determines whether the attack is successful based on the final prompt word. This solution has a wide adaptability to attack success identification and high efficiency.

[0099] In a specific embodiment, the attack traffic includes network attacks, abnormal logins, viruses, Trojans, etc.

[0100] The log types of the original log of the attack traffic include HTTP (Hypertext Transfer Protocol), DNS (Domain Name System) commands, TCP (Transmission Control Protocol) sessions, process chains, and command lines.

[0101] The log library stores the original logs of all attack traffic over a period of time.

[0102] Security devices include firewalls, NTA, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), WAF (Web Application Firewall), and host security, etc. The same security device can detect at least one type of attack.

[0103] Furthermore, in one embodiment, when configuring a successful attack identification strategy, the configuration can be performed according to the security product type, that is, a certain type of security product type is applicable to one successful attack identification strategy, and accordingly, all security devices under this type of security product type, when detecting any type of attack traffic, will call up the successful attack identification strategy corresponding to the security product type, and perform subsequent identification operations according to the prompt word template in the successful attack identification strategy, that is, all security devices of the same type of security product type use the same successful attack identification method, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy.

[0104] When configuring a successful attack identification strategy, you can also configure it according to the security device, that is, a certain security device adapts to a successful attack identification strategy. Accordingly, when this security device detects any type of attack traffic, it calls up the successful attack identification strategy corresponding to the security product type, and performs subsequent identification operations based on the prompt word template in the successful attack identification strategy. That is, the same security device uses the same successful attack identification method, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy.

[0105] The coverage of the attack success identification policy configured according to the security product type is greater than the coverage of the attack success policy configured according to the security device. However, the policy accuracy of the attack success identification policy configured according to the security product type is less than the policy accuracy of the attack success policy configured according to the security device. How to configure the security attack policy should be flexibly adjusted according to actual needs.

[0106] Further, in one embodiment, when configuring the attack success identification strategy, it can be configured according to the attack type, that is, a certain type of attack is applicable to a successful attack identification strategy. Accordingly, all security devices that can detect this type of attack will call the successful attack identification strategy corresponding to the attack type when detecting the attack traffic of this type, and perform subsequent identification operations according to the prompt word template in the successful attack identification strategy. That is, all security devices that can detect the same type of attack use the same successful attack identification method when detecting a specific type of attack traffic, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy. Exemplarily, the attack type can be a network attack, abnormal login, or virus Trojan, etc., and the webshell upload event is a type of attack under the network attack.

[0107] When configuring a successful attack identification strategy, you can also configure it according to the type of attack, that is, a certain type of attack adapts to a successful attack identification strategy. Accordingly, all security devices that can detect this type of attack will call up the successful attack identification strategy corresponding to the attack type when detecting this type of attack traffic, and perform subsequent identification operations based on the prompt word template in the successful attack identification strategy. That is, all security devices that can detect the same type of attack use the same successful attack identification method when detecting a specific type of attack traffic, thereby increasing the coverage of a single successful attack identification strategy and reducing the difficulty of configuring the successful attack identification strategy.

[0108] The coverage of the attack success identification policy configured based on attack type is greater than that of the attack success policy configured based on attack type. However, the policy accuracy of the attack success identification policy configured based on attack type is less than that of the attack success policy configured based on attack type. How to configure the security attack policy can be flexibly adjusted according to actual needs.

[0109] Among them, the functional implementation of each module in the above-mentioned general system for successfully identifying attacks through a large model corresponds to the steps in the above-mentioned general method embodiment for successfully identifying attacks through a large model, and their functions and implementation processes will not be repeated here one by one.

[0110] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0111] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0112] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0113] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0114] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0115] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0116] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A general method for identifying successful attacks through a large model, characterized in that: The method comprises: Pre-configure the policy library and log library. The policy library contains multiple attack success identification policies. Each attack success identification policy includes a prompt word template for the corresponding attack traffic. After detecting attack traffic, the security device issues an alarm and stores the original log of the attack traffic in the log library; According to the alarm information, the corresponding attack success identification strategy is retrieved from the strategy library, and all log types in the log library are added to the corresponding prompt word template to obtain the preliminary prompt word; Input the preliminary prompt words into the large model to obtain the required log type; Extract log content data from the required log type, optimize the preliminary prompt words according to the log content data, and obtain the intermediate prompt words; Input the intermediate prompt words into the large model to obtain the detection sentence; Search the log library according to the detection sentence to obtain the search results, and optimize the intermediate prompt words according to the search results to obtain the final prompt words; The final prompt word is input into the large model to obtain the successful attack recognition result.

2. The general method for identifying successful attacks through a large model as claimed in claim 1, characterized in that: The configuration strategy library specifically includes the following steps: Corresponding multiple attack success identification strategies are pre-configured for multiple security product types and / or security devices to form a strategy library, and the same security product type includes multiple security devices.

3. The general method for identifying successful attacks through a large model as claimed in claim 1, characterized in that: The configuration strategy library specifically includes the following steps: Corresponding multiple attack success identification strategies are configured in advance for multiple attack types and / or attack categories to form a strategy library, and the same attack type includes multiple attack categories.

4. The general method for identifying successful attacks through a large model as claimed in claim 1, characterized in that: The types of attack traffic include network attacks, abnormal logins, and viruses and Trojans.

5. The general method for identifying successful attacks through a large model as claimed in claim 1, characterized in that: The prompt word template includes warning information and analysis ideas.

6. The general method for identifying successful attacks through a large model as claimed in claim 1, characterized in that: The log content data includes field name, field sample data, and field description.

7. The general method for identifying successful attacks through a large model as claimed in claim 1, characterized in that: After the intermediate prompt word is input into the large model, the large model obtains the intermediate prompt word according to the alarm information, analysis ideas, and log content data.

8. A general system for identifying successful attacks through a large model, characterized in that: The system comprises: A pre-configuration module, which is used to pre-configure a policy library and a log library, wherein the policy library includes multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic; A data processing module is used to control the security device to issue an alarm message and store the original log of the attack traffic into a log library after detecting the attack traffic; The attack identification module is used to retrieve the corresponding attack success identification strategy from the strategy library according to the alarm information, and add all log types in the log library to the corresponding prompt word template to obtain preliminary prompt words; input the preliminary prompt words into the large model to obtain the required log type; extract log content data from the required log type, optimize the preliminary prompt words according to the log content data, and obtain intermediate prompt words; input the intermediate prompt words into the large model to obtain intermediate prompt words; search the log library according to the detection statement to obtain the search result, optimize the intermediate prompt words according to the search result to obtain the final prompt word; input the final prompt word into the large model to obtain the attack success identification result.

9. The general system for identifying successful attacks through a large model as claimed in claim 8, characterized in that: The prompt word template includes warning information and analysis ideas.

10. The universal system for identifying successful attacks through a large model as claimed in claim 8, characterized in that: The log content data includes field name, field sample data, and field description.

Images