A general method and system for identifying successful attacks using large models.

Abstract

A general method and system for identifying successful attacks using a large-scale model, belonging to the field of network security, includes: pre-configuring a policy library and a log library; retrieving corresponding attack success identification policies from the policy library based on alarm information, and adding all log types from the log library to corresponding prompt word templates to obtain preliminary prompt words; inputting the preliminary prompt words into the large-scale model to obtain the required log types; optimizing the preliminary prompt words based on log content data to obtain intermediate prompt words; inputting the intermediate prompt words into the large-scale model to obtain intermediate prompt words; retrieving the log library based on detection statements to obtain search results, and optimizing the intermediate prompt words based on the search results to obtain the final prompt word; inputting the final prompt word into the large-scale model to obtain the attack success identification result. This application adjusts the attack success identification policies applicable to attack traffic through the policy library, dynamically generates prompt words through the large-scale model and log library, and the large-scale model judges whether the attack is successful based on the prompt words, with wide adaptability and high efficiency.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, specifically to a general method and system for identifying successful attacks using large-scale models. Background Technology

[0002] In the field of network traffic security detection, security products such as NTA (NetFlow Traffic Analyzer) are already able to detect a variety of attacks and generate a large number of security alerts. However, among various attack methods, how to identify the threatening successful attack events that need to be focused on remains the main challenge facing current technology.

[0003] Traditional methods typically involve writing specific rules for attack detection. For example, some rules can detect specific characteristics of JNDI (Java Naming and Directory Interface) attacks, such as malicious outbound domains, and extract domain names using regular expressions to query DNS (Domain Name System) resolution logs to confirm the success of the attack. However, this approach has several drawbacks. First, writing and adapting rules is tedious and time-consuming, especially in complex attack scenarios such as Java command execution, making it difficult to cover all possible variations. Second, each attack scenario needs to be analyzed and corresponding rules developed, resulting in a huge workload, and even with significant resources, it is difficult to exhaustively cover all attack scenarios.

[0004] Therefore, there is an urgent need for a general-purpose technology to effectively identify the risks of a successful attack, in order to overcome the limitations of existing technologies. Summary of the Invention

[0005] This application provides a general method and system for identifying successful attacks using a large model, which can solve the technical problems of narrow applicability of successful attack identification rules and low efficiency of successful attack identification in the prior art.

[0006] In a first aspect, embodiments of this application provide a general method for identifying successful attacks through large models, characterized in that the method includes:

[0007] A pre-configured policy library and log library are provided. The policy library contains multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic.

[0008] After detecting attack traffic, the security device issues an alarm message and stores the raw logs of the attack traffic in the log database;

[0009] Based on the alarm information, the corresponding attack success identification policy is retrieved from the policy library, and all log types in the log library are added to the corresponding prompt word template to obtain the preliminary prompt words;

[0010] Input the initial prompts into the large model to obtain the required log types;

[0011] Extract log content data from the required log types, optimize the initial prompts based on the log content data, and obtain intermediate prompts;

[0012] Input the intermediate prompt words into the large model to obtain the detection statement;

[0013] The log database is searched based on the detection statement to obtain the search results. The intermediate prompt words are then optimized based on the search results to obtain the final prompt words.

[0014] The final prompt word is input into the large model to obtain the result of successful attack recognition.

[0015] In conjunction with the first aspect, in one implementation, the configuration strategy library specifically includes the following steps:

[0016] Multiple attack success identification policies are pre-configured for various security product types and / or security devices to form a policy library, with the same security product type including multiple security devices.

[0017] In conjunction with the first aspect, in one implementation, the configuration strategy library specifically includes the following steps:

[0018] Multiple attack success identification strategies are pre-configured for various attack types and / or attack categories to form a strategy library, with the same attack type including multiple attack categories.

[0019] In conjunction with the first aspect, in one implementation, the types of attack traffic include network attacks, abnormal logins, and viruses / Trojans.

[0020] In conjunction with the first aspect, in one implementation, the prompt word template includes alarm information and analysis ideas.

[0021] In conjunction with the first aspect, in one implementation, the log content data includes field names, field example data, and field descriptions.

[0022] In conjunction with the first aspect, in one implementation, after the intermediate prompt word is input into the large model, the large model obtains the intermediate prompt word based on alarm information, analysis ideas, and log content data.

[0023] Secondly, embodiments of this application provide a general-purpose system for identifying successful attacks through large-scale modeling, the system comprising:

[0024] The pre-configuration module is used to pre-configure the policy library and log library. The policy library contains multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic.

[0025] The data processing module is used to control the security device to issue alarm information and store the raw logs of the attack traffic into the log database after detecting attack traffic.

[0026] The attack identification module retrieves the corresponding attack success identification strategy from the policy library based on alarm information, adds all log types from the log library to the corresponding prompt word template to obtain preliminary prompt words; inputs the preliminary prompt words into the large model to obtain the required log types; extracts log content data from the required log types, optimizes the preliminary prompt words based on the log content data to obtain intermediate prompt words; inputs the intermediate prompt words into the large model to obtain intermediate prompt words; searches the log library based on the detection statement to obtain search results, optimizes the intermediate prompt words based on the search results to obtain the final prompt words; inputs the final prompt words into the large model to obtain the attack success identification result.

[0027] The beneficial effects of the technical solutions provided in this application include:

[0028] Multiple attack success identification strategies are pre-configured for various attack traffic types. After detecting attack traffic, the security device retrieves the corresponding attack success identification strategy and stores the original logs of the attack traffic in the log database. The attack success identification strategy includes prompt word templates for identifying successful attacks for the corresponding attack traffic. The prompt word templates are optimized by combining the large model and the original logs in the log database to dynamically generate a method for judging data capture. That is, through multiple optimizations, preliminary prompt words, intermediate prompt words, and final prompt words are obtained in sequence. The large model determines whether the attack is successful based on the final prompt word. This solution has wide adaptability and high efficiency for attack success identification. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating an embodiment of the general method for successfully identifying attacks using a large model, as described in this application.

[0030] Figure 2 This is a schematic diagram of a specific embodiment of the general method for successfully identifying attacks using a large model, as described in this application.

[0031] Figure 3 This is a schematic diagram of the functional modules of an embodiment of a general-purpose system that successfully identifies attacks using large models, as described in this application. Detailed Implementation

[0032] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0034] Firstly, embodiments of this application provide a general method for identifying successful attacks through large models.

[0035] In one embodiment, reference is made to Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the general method for successfully identifying attacks using a large model, as described in this application. Figure 1 As shown, general methods for identifying successful attacks using large models include:

[0036] Step S1: Pre-configure the policy library and log library. The policy library contains multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic.

[0037] Step S2: After detecting the attack traffic, the security device issues an alarm message and stores the raw log of the attack traffic in the log database.

[0038] Step S3: Retrieve the corresponding attack success identification policy from the policy library based on the alarm information, and add all log types in the log library to the corresponding prompt word template to obtain the preliminary prompt words;

[0039] Step S4: Input the initial prompts into the large model to obtain the required log type;

[0040] Step S5: Extract log content data from the required log type, optimize the initial prompt words based on the log content data, and obtain intermediate prompt words;

[0041] Step S6: Input the intermediate prompt words into the large model to obtain the intermediate prompt words;

[0042] Step S7: Search the log database based on the detection statement to obtain the search results, and optimize the intermediate prompt words based on the search results to obtain the final prompt words;

[0043] Step S8: Input the final prompt word into the large model to obtain the attack success recognition result.

[0044] In this embodiment, multiple attack success identification strategies are pre-configured for various attack traffic types. After detecting attack traffic, the security device retrieves the corresponding attack success identification strategy and stores the original logs of the attack traffic in the log database. The attack success identification strategy includes prompt word templates for identifying successful attacks for the corresponding attack traffic. The prompt word templates are optimized by combining the large model and the original logs in the log database to dynamically generate a method for judging data capture. That is, through multiple optimizations, preliminary prompt words, intermediate prompt words, and final prompt words are obtained in sequence. The large model judges whether the attack is successful based on the final prompt word. This solution has wide adaptability and high efficiency for attack success identification.

[0045] In one specific embodiment, attack traffic includes network attacks, abnormal logins, and viruses / Trojans.

[0046] The raw logs of attack traffic include HTTP (Hypertext Transfer Protocol), DNS (Domain Name System) commands, TCP (Transmission Control Protocol) sessions, process chains, and command lines.

[0047] The log repository stores raw logs of all attack traffic over a period of time.

[0048] Security devices include firewalls, NTAs, IDS (Intrusion Detection Systems), IPS (Intrusion Prevention Systems), WAFs (Web Application Firewalls), and host security systems. A single security device can detect at least one type of attack.

[0049] Furthermore, in one embodiment, configuring the pre-configured policy library specifically includes the following steps:

[0050] Multiple attack success identification policies are pre-configured for various security product types and / or security devices to form a policy library, with the same security product type including multiple security devices.

[0051] In this embodiment, when configuring the attack success identification strategy, it can be configured according to the security product type. That is, a certain type of security product applies to a certain attack success identification strategy. Correspondingly, when all security devices under this type of security product detect any kind of attack traffic, they will call the attack success identification strategy corresponding to this type of security product and perform subsequent identification operations according to the prompt word template in the attack success identification strategy. In other words, all security devices of the same type of security product use the same attack success identification method, thereby improving the coverage of a single attack success identification strategy and reducing the configuration difficulty of the attack success identification strategy.

[0052] When configuring an attack success identification policy, it can also be configured according to the security device. That is, a certain security device can be adapted to a certain attack success identification policy. Accordingly, when this security device detects any type of attack traffic, it will call the attack success identification policy corresponding to that security product type and perform subsequent identification operations according to the prompt word template in the attack success identification policy. In other words, the same security device uses the same attack success identification method, thereby increasing the coverage of a single attack success identification policy and reducing the configuration difficulty of the attack success identification policy.

[0053] The coverage of attack success identification policies configured based on security product type is greater than that configured based on security device type. However, the policy precision of attack success identification policies configured based on security product type is less than that configured based on security device type. Therefore, the security attack policy should be flexibly adjusted according to actual needs.

[0054] Furthermore, in one embodiment, configuring the pre-configured policy library specifically includes the following steps:

[0055] Multiple attack success identification strategies are pre-configured for various attack types and / or attack categories to form a strategy library, with the same attack type including multiple attack categories.

[0056] In this embodiment, when configuring the attack success identification policy, it can be configured according to the attack type. That is, a certain attack type applies to a certain attack success identification policy. Correspondingly, all security devices that can detect this type of attack will retrieve the attack success identification policy corresponding to this attack type when they detect attack traffic of this type, and perform subsequent identification operations according to the prompt word template in the attack success identification policy. In other words, all security devices that can detect the same type of attack use the same attack success identification method when they detect a specific type of attack traffic, thereby improving the coverage of a single attack success identification policy and reducing the configuration difficulty of the attack success identification policy. For example, the attack type can be a network attack, abnormal login, or virus / Trojan, etc. Webshell upload events are a type of attack under network attacks.

[0057] When configuring attack success identification policies, they can also be configured according to attack types. That is, a certain attack type can be adapted to a certain attack success identification policy. Correspondingly, all security devices that can detect this type of attack will retrieve the attack success identification policy corresponding to this attack type when they detect this type of attack traffic, and perform subsequent identification operations according to the prompt word template in the attack success identification policy. In other words, all security devices that can detect the same type of attack will use the same attack success identification method when they detect a specific type of attack traffic, thereby improving the coverage of a single attack success identification policy and reducing the configuration difficulty of the attack success identification policy.

[0058] The coverage of an attack success identification policy configured based on attack type is greater than that of an attack success identification policy configured based on attack type. However, the policy precision of an attack success identification policy configured based on attack type is less than that of an attack success identification policy configured based on attack type. Therefore, the security attack policy should be flexibly adjusted according to actual needs.

[0059] Furthermore, in one embodiment, multiple attack success identification strategies can be configured simultaneously based on the type of security product, security device, attack type, and attack category.

[0060] Furthermore, in one embodiment, the prompt word template includes alarm information and analysis ideas.

[0061] The log content data includes field names, field example data, and field descriptions.

[0062] After the intermediate prompt words are input into the large model, the large model obtains the intermediate prompt words based on the alarm information, analysis ideas, and log content data.

[0063] In this embodiment, refer to Figure 2 , Figure 2This diagram illustrates a specific embodiment of a general method for identifying successful attacks using a large model, based on the present application. Taking an NTA-collected webshell upload event as an example, after detecting attack traffic from the webshell upload event, the NTA issues an alarm message. Simultaneously, the original logs of the webshell upload event are stored in a log database. Based on the alarm message, a corresponding attack success identification strategy is retrieved from a pre-configured strategy database. This strategy includes a prompt word template that can be used to identify whether the webshell upload event was successfully attacked. The alarm message and the log types of all original logs in the log database are added to the prompt word template to obtain preliminary prompt words. These preliminary prompt words are input into the large model. The large model, combined with the preliminary prompt words, filters from all log types to select the log types required to identify whether the webshell upload event was successfully attacked—that is, the logs associated with the attack traffic. Log content data is extracted from the required log types, and the preliminary prompt words are optimized based on the log content data to obtain intermediate prompt words. These intermediate prompt words are input into the large model, and the large model, combined with the intermediate prompt words, generates a detection statement. The system retrieves data from the log database based on the detection statement. For example, if the data contains the fields specified in the query statement, the subsequent large-scale model considers the attack successful. If the data does not contain the fields specified in the query statement, the subsequent large-scale model considers the attack unsuccessful.

[0064] Specifically, after NTA detects a suspected webshell upload event, it issues an alert and logs the alert.

[0065] {

[0066] "alert_id":"A20231028001",

[0067] "timestamp":"2023-10-28T10:15:00Z",

[0068] "source_ip":"192.168.1.100",

[0069] "destination_ip":"10.0.0.5",

[0070] "destination_port":80,

[0071] "alert_type":"Webshell Upload Attempt",

[0072] "request_uri":" / upload.php",

[0073] "http_status":200

[0074] }

[0075] Meanwhile, the raw traffic of the related accesses is also recorded and collected in the HTTP raw log table.

[0076] The attack success identification strategies in the strategy library are divided into detailed strategies and fallback strategies. Based on major categories such as alarm devices and / or alarm sources (the same alarm source contains multiple alarm devices), default fallback strategies are created. For example, the large model is used to determine the alarm type. If the alarm type is a network attack type alarm, then the attack success identification strategy and prompt word template for the network attack type are used. In this way, default prompt word templates are built to ensure that all alarms can be analyzed by the large model.

[0077] While fallback strategies are relatively broad and adaptable to all scenarios, they lack detailed guidance for analysis. For example, regarding the webshell upload alert mentioned above, we can create detailed strategies for specific alert names or clear types (multiple alert names within the same alert type). When standardizing the large model's approach to successfully determining webshell upload event alerts using detailed strategies, the network layer analyzes whether there is subsequent access traffic to the webshell address. If there is access traffic, it determines whether communication with the webshell is already underway to decide if the webshell upload was successful.

[0078] In the strategy library, synchronously, the strategy instructs the large model to analyze which logs need to be included in the analysis based on the alarm content. At this point, a list of log types from the log library is provided to the large model as context through initial prompts, allowing the model to autonomously select the necessary raw logs. After confirmation, the detailed field names, sample field data, and descriptions of the corresponding log type are uniformly entered into the overall analysis strategy prompts through the prompt template. That is, through the intermediate prompts, the large model analyzes how to query the raw logs to determine whether the alarm is a successful attack event based on the alarm content, analysis approach, and data situation. At this point, a query statement generated based on the associated data type is obtained. For example:

[0079] SELECT*

[0080] FROM http_raw_traffic_logs

[0081] WHERE destination_ip='10.0.0.5'

[0082] AND timestamp>='2023-10-28T10:15:00Z'

[0083] AND request_uri LIKE' / uploads.php%'

[0084] The generated query statements are automatically scheduled and executed to complete the query of the original logs, for example: [

[0086] {"timestamp":"2023-10-28T10:17:00Z","source_ip":"192.168.1.100","destination_ip":"10.0.0.5","req uest_uri":" / uploads / shell.php?cmd=whoami","http_status":200,"response_content_base64":"cm9vdA==""} ]

[0088] Based on the query results, the final prompt is fed back to the big model. The big model can then comprehensively analyze and determine whether the attack was successful and the reasons for the determination, based on the alarm content and the query log results.

[0089] For example:

[0090] Based on the above query results, the large model found that the attacker accessed / uploads / shell.php after uploading and attempted to execute a command. The command execution result cm9vdA== decoded to root, indicating that the Webshell was successfully uploaded and the whoami command was executed.

[0091] It's important to note that for complex events, large models can require querying multiple types of logs multiple times until the analysis is complete or the predetermined number of iterations is reached. The default limit is a maximum of 3 iterations to avoid excessive iterations consuming performance.

[0092] In summary, the analysis and determination of whether a security attack was successful is highly complex. Traditional rule-based methods are ill-suited for various complex alerts and require significant manpower. This patent utilizes large-scale modeling technology combined with a strategy library based on professional analytical experience to analyze the methods and data needed to determine attack success and proactively acquire further data to corroborate the analysis. Ultimately, it provides a precise method for determining whether an attack was successful. This method exhibits good adaptability, and its capabilities can be quickly expanded or fine-tuned through the strategy library.

[0093] Secondly, embodiments of this application also provide a general-purpose system for identifying successful attacks through large-scale modeling.

[0094] In one embodiment, reference is made to Figure 3 , Figure 3This is a functional module diagram of an embodiment of a general-purpose system that successfully identifies attacks using large models, as described in this application. Figure 3 As shown, general-purpose systems that successfully identify attacks through large-scale modeling include:

[0095] The pre-configuration module 1 is used to pre-configure the policy library and log library. The policy library contains multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic.

[0096] Data processing module 2 is used to control the security device to issue alarm information and store the raw log of the attack traffic into the log database after detecting attack traffic;

[0097] Attack identification module 3 is used to retrieve the corresponding attack success identification strategy from the policy library based on alarm information, add all log types in the log library to the corresponding prompt word template to obtain preliminary prompt words; input the preliminary prompt words into the large model to obtain the required log types; extract log content data from the required log types, optimize the preliminary prompt words based on the log content data to obtain intermediate prompt words; input the intermediate prompt words into the large model to obtain intermediate prompt words; search the log library according to the detection statement to obtain the search results, optimize the intermediate prompt words based on the search results to obtain the final prompt words; input the final prompt words into the large model to obtain the attack success identification result.

[0098] In this embodiment, multiple attack success identification strategies are pre-configured for various attack traffic types. After detecting attack traffic, the security device retrieves the corresponding attack success identification strategy and stores the original logs of the attack traffic in the log database. The attack success identification strategy includes prompt word templates for identifying successful attacks for the corresponding attack traffic. The prompt word templates are optimized by combining the large model and the original logs in the log database to dynamically generate a method for judging data capture. That is, through multiple optimizations, preliminary prompt words, intermediate prompt words, and final prompt words are obtained in sequence. The large model judges whether the attack is successful based on the final prompt word. This solution has wide adaptability and high efficiency for attack success identification.

[0099] In one specific embodiment, attack traffic includes network attacks, abnormal logins, and viruses / Trojans.

[0100] The raw logs of attack traffic include HTTP (Hypertext Transfer Protocol), DNS (Domain Name System) commands, TCP (Transmission Control Protocol) sessions, process chains, and command lines.

[0101] The log repository stores raw logs of all attack traffic over a period of time.

[0102] Security devices include firewalls, NTAs, IDS (Intrusion Detection Systems), IPS (Intrusion Prevention Systems), WAFs (Web Application Firewalls), and host security systems. A single security device can detect at least one type of attack.

[0103] Furthermore, in one embodiment, when configuring the attack success identification strategy, it can be configured according to the security product type. That is, a certain type of security product applies to one attack success identification strategy. Correspondingly, when all security devices under this type of security product detect any kind of attack traffic, they will retrieve the attack success identification strategy corresponding to that security product type and perform subsequent identification operations according to the prompt word template in the attack success identification strategy. In other words, all security devices of the same type of security product use the same attack success identification method, thereby improving the coverage of a single attack success identification strategy and reducing the configuration difficulty of the attack success identification strategy.

[0104] When configuring an attack success identification policy, it can also be configured according to the security device. That is, a certain security device can be adapted to a certain attack success identification policy. Accordingly, when this security device detects any type of attack traffic, it will call the attack success identification policy corresponding to that security product type and perform subsequent identification operations according to the prompt word template in the attack success identification policy. In other words, the same security device uses the same attack success identification method, thereby increasing the coverage of a single attack success identification policy and reducing the configuration difficulty of the attack success identification policy.

[0105] The coverage of attack success identification policies configured based on security product type is greater than that configured based on security device type. However, the policy precision of attack success identification policies configured based on security product type is less than that configured based on security device type. Therefore, the security attack policy should be flexibly adjusted according to actual needs.

[0106] Furthermore, in one embodiment, when configuring the attack success identification policy, it can be configured according to the attack type. That is, a certain attack type applies to a certain attack success identification policy. Correspondingly, all security devices capable of detecting this type of attack will retrieve the attack success identification policy corresponding to this attack type when they detect attack traffic of this type, and perform subsequent identification operations according to the prompt word template in the attack success identification policy. In other words, all security devices capable of detecting the same type of attack use the same attack success identification method when they detect a specific type of attack traffic, thereby improving the coverage of a single attack success identification policy and reducing the configuration difficulty of the attack success identification policy. For example, the attack type can be a network attack, abnormal login, or virus / Trojan, etc. Webshell upload events are a type of attack under network attacks.

[0107] When configuring attack success identification policies, they can also be configured according to attack types. That is, a certain attack type can be adapted to a certain attack success identification policy. Correspondingly, all security devices that can detect this type of attack will retrieve the attack success identification policy corresponding to this attack type when they detect this type of attack traffic, and perform subsequent identification operations according to the prompt word template in the attack success identification policy. In other words, all security devices that can detect the same type of attack will use the same attack success identification method when they detect a specific type of attack traffic, thereby improving the coverage of a single attack success identification policy and reducing the configuration difficulty of the attack success identification policy.

[0108] The coverage of an attack success identification policy configured based on attack type is greater than that of an attack success identification policy configured based on attack type. However, the policy precision of an attack success identification policy configured based on attack type is less than that of an attack success identification policy configured based on attack type. Therefore, the security attack policy should be flexibly adjusted according to actual needs.

[0109] The functions of each module in the general system that successfully identifies attacks through large models correspond to the steps in the general method embodiment that successfully identifies attacks through large models. Their functions and implementation processes will not be described in detail here.

[0110] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0111] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit the "first", "second" and "third" to different types.

[0112] In the description of the embodiments of this application, the words "exemplary," "for example," or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary," "for example," or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary," "for example," or "for example" is intended to present the relevant concepts in a concrete manner.

[0113] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0114] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0116] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A general method for identifying successful attacks using large models, characterized in that, The method includes: A pre-configured policy library and log library are provided. The policy library contains multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic. After detecting attack traffic, the security device issues an alarm message and stores the raw logs of the attack traffic in the log database; Based on the alarm information, the corresponding attack success identification policy is retrieved from the policy library, and all log types in the log library are added to the corresponding prompt word template to obtain the preliminary prompt words; Input the initial prompts into the large model to obtain the required log types; Extract log content data from the required log types, optimize the initial prompts based on the log content data, and obtain intermediate prompts; Input the intermediate prompt words into the large model to obtain the detection statement; The log database is searched based on the detection statement to obtain the search results. The intermediate prompt words are then optimized based on the search results to obtain the final prompt words. The final prompt word is input into the large model to obtain the result of successful attack recognition.

2. The general method for identifying successful attacks through large models as described in claim 1, characterized in that, The configuration strategy library specifically includes the following steps: Multiple attack success identification policies are pre-configured for various security product types and / or security devices to form a policy library, with the same security product type including multiple security devices.

3. The general method for identifying successful attacks through large models as described in claim 1, characterized in that, The configuration strategy library specifically includes the following steps: Multiple attack success identification strategies are pre-configured for various attack types and / or attack categories to form a strategy library, with the same attack type including multiple attack categories.

4. The general method for identifying successful attacks through large models as described in claim 1, characterized in that, The types of attack traffic include network attacks, abnormal logins, and viruses / Trojans.

5. The general method for identifying successful attacks through large models as described in claim 1, characterized in that, The prompt word template includes alarm information and analysis ideas.

6. The general method for identifying successful attacks through large models as described in claim 1, characterized in that, The log content data includes field names, field example data, and field descriptions.

7. The general method for identifying successful attacks through large models as described in claim 1, characterized in that, After the intermediate prompt words are input into the large model, the large model obtains the intermediate prompt words based on the alarm information, analysis ideas, and log content data.

8. A general-purpose system for identifying successful attacks using large-scale models, characterized in that, The system includes: The pre-configuration module is used to pre-configure the policy library and log library. The policy library contains multiple attack success identification policies, and each attack success identification policy includes a prompt word template for the corresponding attack traffic. The data processing module is used to control the security device to issue alarm information and store the raw logs of the attack traffic into the log database after detecting attack traffic. The attack identification module retrieves the corresponding attack success identification strategy from the policy library based on alarm information, adds all log types from the log library to the corresponding prompt word template to obtain preliminary prompt words; inputs the preliminary prompt words into the large model to obtain the required log types; extracts log content data from the required log types, optimizes the preliminary prompt words based on the log content data to obtain intermediate prompt words; inputs the intermediate prompt words into the large model to obtain intermediate prompt words; searches the log library based on the detection statement to obtain search results, optimizes the intermediate prompt words based on the search results to obtain the final prompt words; inputs the final prompt words into the large model to obtain the attack success identification result.

9. The general-purpose system for identifying successful attacks through large-scale model recognition as described in claim 8, characterized in that, The prompt word template includes alarm information and analysis ideas.

10. The general-purpose system for identifying successful attacks through large-scale model recognition as described in claim 8, characterized in that, The log content data includes field names, field example data, and field descriptions.

Images