A network risk assessment method and system based on a multi-modal data pre-training model

Abstract

The present application relates to a kind of network risk assessment method and system based on multimodal data pre-training model.The method first acquires multi-source network security data, identifies the threat event object in it, and connects threat event object as attack chain, analysis obtains the feature information and main attack node of each attack chain;And evaluate and generate the risk level information of the attack chain;Integrate the above information, generate and continuously record network security posture report;Again, pre-construct network security posture knowledge base;Finally, the feature information of attack chain is matched and compared with the attack chain data in network security posture knowledge base, predict potential threat influence, generate early warning information and protection strategy suggestion.Compared with prior art, the present application has the advantages of not depending on predefined rule, more suitable for complex network scene, improve the reliability and accuracy of network security situation awareness, etc..

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security risk assessment, and particularly relates to a network risk assessment method and system based on a multi-modal data pre-training model. BACKGROUND

[0002] Currently, in the field of network security situation awareness and risk assessment, the existing methods relying on rule detection and traditional machine learning have low efficiency in processing multi-source and multi-modal data (such as logs, network traffic, and user behavior data), and it is difficult to achieve comprehensive analysis of events and threats. Moreover, the traditional methods mainly rely on known attack patterns or pre-set rules, and have poor adaptability to new threats (such as zero-day attacks), which leads to difficulty in maintaining high protection capability in dynamic network environments.

[0003] In the security maintenance scenario of network systems, improving the accuracy of security situation awareness and risk assessment for new threats is the key to enhancing the protection capability of network systems. However, the significant deficiencies in adaptability, real-time performance, and scalability of existing methods make it difficult for them to effectively cope with complex and large-scale new threats. Existing network security situation awareness methods have great limitations in dealing with complex threats in new network systems. Although rule-based and signature-based detection techniques can quickly identify known threats, they highly depend on predefined rules and feature signatures, and have poor adaptability to zero-day attacks and variant attacks, and the maintenance cost of rules and feature libraries is high. Machine learning methods can learn attack patterns from historical data, but they are usually only suitable for structured data and difficult to handle a large amount of unstructured or semi-structured security data emerging in new network systems. In addition, machine learning models rely on a large amount of high-quality labeled data, which has high acquisition cost and limited generalization ability. Although deep learning methods can identify complex patterns to some extent, they have high computational requirements for data and poor interpretability due to the "black box" nature of the model, which also limits their application in complex scenarios.

[0004] The invention patent with publication number CN117978545B discloses a network security risk assessment method based on a large model. The method collects network security risk assessment original data to obtain a basic network security data set. Data labels are set for the data set to obtain a risk assessment data label library. Network security risk assessment element feature engineering analysis is performed to obtain a risk assessment feature data set. The functional relationship between risks and risk results is determined, a network security risk assessment large model is constructed and supervised training, verification analysis and model optimization are performed. Network security risk assessment is performed on actual network systems to obtain network security risk assessment results. An evaluation result and protection strategy linkage mechanism is established to continuously perform network security risk assessment and strategy linkage, and to optimize network security risk assessment results. However, this method still has poor adaptability to zero-day attacks and variant attacks, and high maintenance cost of rules and feature libraries. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art and provide a network risk assessment method and system based on a multi-modal data pre-training model.

[0006] The purpose of the present application can be achieved by the following technical solutions:

[0007] According to one aspect of the present application, a network risk assessment method based on a multi-modal data pre-training model is provided. The method is based on a pre-trained and fine-tuned network security vertical large model, and uses correlation analysis technology and retrieval and generation (RAG) technology to perform network risk assessment. The method steps include:

[0008] S1. Collecting multi-source network security data, preprocessing and semantic processing the data, and establishing a correlation relationship between events in the network security data;

[0009] S2. Identifying threat event objects in the network security data based on the network security vertical large model, and based on the established correlation relationship, connecting the threat event objects into multiple complete attack chains, further analyzing to extract feature information and main attack nodes of each attack chain;

[0010] S3. Based on the feature information of each attack chain, evaluating and generating risk level information of the attack chain based on the network security vertical large model;

[0011] S4. Integrating the feature information of the attack chain, the main attack nodes and the risk level information, generating and continuously recording a network security situation report;

[0012] S5, constructing a network security posture knowledge base covering different attack chain patterns, development paths and protection strategies in advance based on historical attack chain data and known threat behaviors;

[0013] S6, based on the network security vertical large model, matching and comparing the feature information of the attack chain with the attack chain data in the network security posture knowledge base, predicting potential threat impacts, and generating early warning information and protection strategy suggestions.

[0014] As a preferred technical solution, the pre-training of the security vertical large model is to train the base large language model of InternLM2.5-7B using network security related corpus, and the fine-tuning is to fine-tune the pre-trained large model using network security related question and answer pairs, so that it has the reasoning ability to answer network security questions.

[0015] As a preferred technical solution, the sources of the multi-source network security data in S1 include network logs, traffic data and user behavior records, and the preprocessing includes cleaning, denoising and format conversion of the multi-source network security data.

[0016] As a preferred technical solution, the establishment of the association relationship between the events in the network security data in S1 is specifically: establishing the association between the events in the network security data according to the source, category, time sequence and logical relationship.

[0017] As a preferred technical solution, in S2, the threat event objects are identified to extract key threat elements, and after extraction, they are converted into standard JSON format event objects; the key threat elements include event ID, timestamp, threat source, threat type, impact range, event description and confidence.

[0018] As a preferred technical solution, the feature information in S2 includes the length of the attack chain, the node attack content, the attack complexity and the asset value of the attack target.

[0019] As a preferred technical solution, the specific steps of S3 for evaluating and generating the risk level information of the attack chain are: using the network security vertical large model based on pre-training and fine-tuning, according to the feature information of each attack chain, evaluating the risk of the corresponding attack chain, and giving the risk level evaluation result to help the security team to respond to high-risk events first.

[0020] The risk level evaluation result includes four levels of low, medium, high and extremely high.

[0021] As a preferred technical solution, the protection strategy in S5 includes: effective protection strategies proposed by network security experts based on existing attack chains and protection strategies for related attack behaviors in the existing network security knowledge base.

[0022] As a preferred technical solution, S6 is specifically to match and compare the attack chain in the current report with the attack chain in the network security situation knowledge base by using the RAG technology.

[0023] According to another aspect of the present disclosure, there is provided a network risk assessment system based on a multimodal data pre-training model, which works according to the network risk assessment method based on a multimodal data pre-training model as described above.

[0024] The data acquisition and preprocessing module is configured to acquire multi-source network security data, perform data preprocessing and semantic processing, and identify threat event objects therein.

[0025] The attack chain construction module is configured to establish associations between the threat event objects, link them into multiple complete attack chains, and analyze the feature information and main attack nodes of each attack chain.

[0026] The risk assessment module is configured to assess and generate the risk level of each attack chain according to the feature information of the attack chain.

[0027] The situation report and knowledge base construction module is configured to integrate the feature information, main attack nodes and risk level information of the attack chains, generate and continuously record network security situation reports, and pre-construct a network security situation knowledge base covering different attack chain modes, development paths and protection strategies based on historical attack chain data and known threat behaviors.

[0028] Compared with the prior art, the present application has the following beneficial effects:

[0029] 1. The network risk assessment method in the application is based on a pre-trained and fine-tuned network security vertical large model, and uses correlation analysis and RAG technology to assess network risks. The method collects multi-source network security data, pre-processes and semantically processes the data, and identifies threat event objects based on the network security vertical large model. The objects are connected into attack chains, and the characteristic information and main attack nodes of each attack chain are analyzed. Then, based on the characteristic information of each attack chain, the network security vertical large model is used to assess and generate risk level information for the attack chain. Next, the characteristic information, main attack nodes and risk level information of the attack chain are integrated to generate and continuously record network security posture reports. Based on historical attack chain data and known threat behaviors, a network security posture knowledge base covering different attack chain patterns, development paths and protection strategies is pre-constructed. Finally, the characteristic information of the attack chain is matched and compared with the attack chain data in the network security posture knowledge base to predict potential threat impacts and generate early warning information and protection strategy suggestions. This method does not rely on predefined rules, but automatically learns deep features and semantic associations of attacks on massive multi-modal data through pre-training, capturing potential patterns and associations of attack behaviors in complex scenarios. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavior characteristics or abnormal log information, and further provide corresponding explainable decisions, improving the reliability of network security situation awareness.

[0030] 2. The network security vertical large model used in the application is pre-trained and fine-tuned. The pre-training is to train the base large language model of InternLM2.5-7B using network security related corpus, and the fine-tuning is to fine-tune the pre-trained large model using network security related question and answer pairs to make it have reasoning ability to answer network security questions. It has strong capabilities of processing multi-modal data, automatic threat element identification and dynamic event correlation, which can effectively make up for the shortcomings of traditional network security situation awareness and risk assessment methods. Its strong context understanding, semantic analysis and logical reasoning ability make it more accurate for network security situation awareness and risk assessment tasks.

[0031] 3. The sources of multi-source network security data in the application include network logs, traffic data and user behavior records, and the correlation between threat event objects is established according to threat event sources, threat event categories, time sequence and logical relationships. This significantly improves the network system's ability to integrate and analyze large-scale, multi-source threat data, and generates structured attack chains and network security posture reports through semantic data processing and correlation analysis of same-source or same-type event objects.

[0032] 4、The application combines the attack chain in the current report with the attack chain in the network security situation knowledge base, and uses RAG technology to match and compare them, so that the future potential attack behavior can be accurately predicted, and the warning and protection strategies can be automatically generated, and the network security protection capability is effectively improved.

[0033] 5、The threat event object is converted into a standard JSON format event object after being identified, the structured JSON format is used to clearly express each data feature information, the information is further effectively integrated, the data features have context meaning, and the relevance between different data features and the overall trend are more obvious. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 A method flow framework diagram of a network risk assessment method based on a multi-modal data pre-training model in the application;

[0035] Figure 2 A code example diagram of power network data semantic processing in the embodiment;

[0036] Figure 3 A code example diagram of converting into a standard JSON format event in the embodiment;

[0037] Figure 4 A code example diagram of the integrated threat event object in the embodiment;

[0038] Figure 5 A code example diagram of the power network security situation report in the embodiment;

[0039] Figure 6 A code example diagram of the output of the power network security situation prediction in the embodiment. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the application.

[0041] Currently, in the field of network security situation awareness and risk assessment, existing methods relying on rule detection and traditional machine learning are inefficient in handling multi-source, multi-modal data such as logs, network traffic, and user behavior data, making it difficult to achieve comprehensive analysis of events and threats. Moreover, traditional methods mainly rely on known attack patterns or pre-set rules, which have poor adaptability to new threats such as zero-day attacks, making it difficult to maintain high protection capabilities in dynamic network environments.

[0042] The rapid development of large language models provides a new approach to network security situation awareness. Through pre-training and fine-tuning on multi-modal data, large language models greatly improve the ability to process and analyze heterogeneous data such as text logs, network traffic, and user behavior. Meanwhile, their excellent context understanding and semantic reasoning capabilities enable them to effectively analyze complex attack chains from correlated events, thus achieving automated attack chain generation and risk analysis, which helps to capture complex new threats. In addition, with the help of external knowledge bases and reasoning capabilities, large language models can automatically generate effective and reliable security policies and response measures based on risk levels, further improving the automation and intelligence level of network system security situation awareness.

[0043] In the context of network system security maintenance, improving the accuracy of security situation awareness and risk assessment for new threats is crucial to enhancing the protection capabilities of network systems. However, existing methods have significant shortcomings in adaptability, real-time performance, and scalability, making it difficult to effectively deal with complex and large-scale new threats. Through investigation and analysis of the current research status at home and abroad, it is found that existing network security situation awareness methods have significant limitations in dealing with complex threats in new network systems. Rule-based and signature-based detection techniques can quickly identify known threats, but they highly depend on pre-defined rules and feature signatures, have poor adaptability to zero-day attacks and variant attacks, and have high maintenance costs for rule and feature libraries.

[0044] Methods based on pre-training large models on multi-modal data do not rely on pre-defined rules, but automatically learn deep features and semantic associations of attacks through pre-training on massive multi-modal data, capturing potential patterns and associations of attack behavior in complex scenarios. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavior characteristics or abnormal log information and further provide corresponding explainable decisions.

[0045] Embodiment 1

[0046] In this embodiment, a network risk assessment method based on a multi-modal data pre-training model is applied, and the method flow framework is as follows Figure 1As shown, based on the pre-trained and fine-tuned network security vertical large model, the correlation analysis is used in combination with the RAG technology for network risk assessment, and the method steps include:

[0047] S1, collect multi-source network security data, pre-process and semanticize the data, and establish correlation between events in the network security data;

[0048] S2, based on the network security vertical large model, identify threat event objects in the network security data, and based on the established correlation, connect the threat event objects into multiple complete attack chains, further analyze, and extract feature information and main attack nodes of each attack chain;

[0049] S3, according to the feature information of each attack chain, based on the network security vertical large model, evaluate and generate the risk level information of the attack chain;

[0050] S4, integrate the feature information, main attack nodes and risk level information of the attack chain, generate and continuously record the network security situation report;

[0051] S5, based on historical attack chain data and known threat behaviors, pre-construct a network security situation knowledge base covering different attack chain modes, development paths and protection strategies;

[0052] S6, based on the network security vertical large model, match and compare the feature information of the attack chain with the attack chain data in the network security situation knowledge base, predict potential threat impact, and generate early warning information and protection strategy suggestions.

[0053] In this scheme, a pre-trained and fine-tuned network security vertical large language model is selected to realize element perception, situation understanding and situation prediction of power network security. The pre-trained and fine-tuned network security vertical large model is trained on a large amount of network security related corpus based on the base large language model of InternLM2.5-7B, and the fine-tuning is to fine-tune the pre-trained large model using network security related question and answer pairs, so that it has the reasoning ability to answer network security problems.

[0054] In this embodiment, firstly, multi-source collection, processing and semantic processing of power network security data and automatic identification of threat elements in the data are performed. Network logs, traffic data and user behavior data are used as data sources to collect raw data of power network security. The collected raw data is further cleaned, denoised and format-converted. Data cleaning and denoising algorithms are used to delete missing values, repeated values and abnormal fluctuation data. For example, a three-exponential smoothing method is used to filter noise peaks in the data. Secondly, semantic processing of power network data is realized by designing corresponding text description templates for different data sources, that is, structured JSON format is used to store data features to enhance the context information of the features, which also lays a foundation for subsequent network security vertical large model to identify threat elements. The semantic template of power network traffic data includes timestamp, source IP, destination IP, request method, response code, traffic peak, and average delay field. The semantic template of user behavior data includes timestamp, user ID, behavior type, access frequency, session duration, and peak access period. An example of the semantic processing result of power network data is shown in Table 1. Figure 2

[0055] Secondly, the pre-trained and fine-tuned network security vertical large language model is used to automatically identify threat event objects in the above semantic multi-source data. Meanwhile, key threat elements of the threat event objects need to be further extracted, including event ID, timestamp, threat source, threat type, impact range, description and confidence. For the identified threat event objects and their threat elements, they need to be further converted into standard JSON format event objects to facilitate the subsequent network security vertical large model to perceive and predict the overall security situation of the power network. An example of the code is shown in Table 2. Figure 3

[0056] In this embodiment, the specific process of analyzing and constructing attack chains and generating power network security situation and risk assessment reports is as follows: based on the above analysis, firstly, the correlation between attacks is automatically generated and embedded by algorithm, that is, the same source (multiple attacks initiated by the same IP or source) and the same type (different sources but similar attack patterns) of events are classified and integrated. By embedding the causal relationship and time sequence relationship structure fields (such as “previous_event_id” and “next_event_id”) into the integrated same source or same type event objects, the internal time sequence relationship or logical relationship of the same source or same type events is associated. An example of the code of the integrated event objects is shown in Table 3. Figure 4

[0057] ​​​Subsequently, based on the threat event object completed integration and relationship structure embedding, further using the network security vertical large model to analyze the time sequence information and potential causal relationship of the same source or same type event object, automatically generate a complete attack chain, and accurately describe the correlation and evolution path between events. At the same time, in the process of generating the attack chain, the network security vertical large model further carries out risk assessment on the entire chain according to the length of the attack chain, the attack complexity, the value of the target asset and the potential impact of the multi-dimensional factors, and gives the risk level evaluation results of low, medium, high and extremely high four levels, to help the security team to respond to high-risk events first. Based on the above analysis results, the network security vertical large model automatically generates a structured network security situation report according to the instructions, which includes detailed description of the attack chain, key nodes, potential threat impact and risk level, helping the security team to quickly understand the overall network security situation and risk status. The code example of the power network security situation report is shown in Figure 5

[0058] In this embodiment, the specific process of power network security situation prediction and defense strategy suggestion generation is as follows: first, based on historical attack chain data and known threat behaviors, a security situation knowledge base containing different types of attack chain patterns, development paths and defense strategies is constructed, and the content of the knowledge base is continuously updated as new attack patterns appear, to ensure that it can provide accurate knowledge support for the large model. Subsequently, the network security vertical large model matches the current attack chain with the attack patterns in the knowledge base through the RAG technology according to the situation report content generated in step 2, and combines the matched knowledge base content to carry out context understanding and reasoning analysis, to predict the potential development direction of the attack chain and the possible next action.

[0059] In this embodiment, the defense strategy includes: the effective defense strategy proposed by the network security expert according to the existing attack chain and the defense strategy for the related attack behavior in the existing network security knowledge base.

[0060] On this basis, the network security vertical large model will further generate warning information and corresponding defense suggestions based on the defense strategies in the knowledge base, such as enabling multi-factor authentication, strengthening sensitive data access monitoring, limiting access of specific IP, etc. The above warning information and strategy suggestions are output in a structured JSON format, ensuring content standardization and easy integration, so as to help the security team to more efficiently cope with potential threats and improve the defense effect. The output code example of the network security vertical large model for power network security situation prediction is shown in Figure 6

[0061] ​​The effectiveness of the method is evaluated by collecting part of the mixed data set containing normal operation and abnormal behavior from the network flow data, system logs and user behavior data in the actual operation environment of the power network system. Considering that the large model not only needs to accurately identify the attack event chain in the power network security situation awareness and risk assessment task, but also needs to propose correct countermeasures for potential attack behaviors, we use accuracy and cosine similarity as indicators for evaluation. Cosine similarity is mainly used to evaluate the similarity between the countermeasures proposed by the network security large model for attack behaviors and the standard countermeasures, so as to reflect the correctness of the countermeasures proposed by the large model. The evaluation results are shown in Table 1. The accuracy of the network security vertical large model + correlation analysis + RAG method has been significantly improved, and the comparison results of cosine similarity also show that the invention can propose more correct countermeasures for the attack behaviors identified from the network system.

[0062] Table 1 Evaluation of power network security situation awareness and risk assessment task

[0063]

[0064] In summary, the method does not rely on pre-defined rules, but automatically learns deep features and semantic associations of attacks through pre-training on massive multi-modal data, capturing potential patterns and associations of attack behaviors in complex scenarios. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavior characteristics or abnormal log information, and further provide corresponding explainable decisions, improving the reliability of network security situation awareness.

[0065] Embodiment 2

[0066] In this embodiment, a network risk assessment system based on a multi-modal data pre-training model is applied. The system includes a data acquisition and preprocessing module, a risk assessment module, a situation report and knowledge base construction module, and a warning and strategy suggestion module.

[0067] The data acquisition and preprocessing module is used to collect multi-source network security data, perform data preprocessing and semantic processing, and identify threat event objects therein;

[0068] The attack chain construction module is used to establish associations between threat event objects, making them serially connected into multiple complete attack chains, and analyzing the feature information and main attack nodes of each attack chain;

[0069] The risk assessment module is used to evaluate and generate the risk level of each attack chain according to the feature information of the attack chain;

[0070] The situation report and knowledge base construction module is used for integrating feature information of attack chains, main attack nodes and risk level information thereof, generating and continuously recording network security situation reports, and pre-constructing a network security situation knowledge base covering different attack chain modes, development paths and protection strategies based on historical attack chain data and known threat behaviors.

[0071] The early warning and strategy suggestion module is used for matching and comparing feature information of attack chains with attack chain data in the network security situation knowledge base, predicting potential threat impacts, and generating early warning information and protection strategy suggestions.

[0072] In the scheme, a pre-trained and fine-tuned network security vertical large language model is selected to realize element perception, situation understanding and situation prediction of power network security. The pre-trained and fine-tuned network security vertical large model is a base large language model of InternLM2.5-7B trained by a large amount of network security related corpus, and the fine-tuning is to fine-tune the pre-trained large model using network security related question and answer pairs to make it have the reasoning ability to answer network security problems.

[0073] In the embodiment, first, multi-source collection, processing and semantic processing of power network security data and automatic identification of threat elements in the data are performed. Network logs, traffic data and user behavior data are used as data sources to collect original data of power network security, and the collected original data is further cleaned, denoised and format converted. Specifically, a data cleaning and denoising algorithm is used to delete missing values, repeated values and abnormal fluctuation data, such as filtering noise peaks in the data by a three-time exponential smoothing method. Secondly, semantic processing of power network data is realized by designing corresponding text description templates for different data sources, that is, structured JSON format is used to store data features to enhance the context information of the features, which also lays a foundation for subsequent network security vertical large model to identify threat elements. Among them, the semantic template of power network traffic data includes timestamp, source IP, destination IP, request method, response code, traffic peak value and average delay field, while the semantic template field of user behavior data includes timestamp, user ID, behavior type, access frequency, session duration and peak access period. An example of the semantic processing result of power network data is shown in Figure 2

[0074] ​Secondly, the pre-trained and fine-tuned network security vertical large language model is used to automatically identify the threat event objects in the above semanticized multi-source data, and further extract the key threat elements of the threat event objects, including event ID, timestamp, threat source, threat type, impact range, description and confidence. For the identified threat event objects and their threat elements, they need to be further converted into standard JSON format event objects to facilitate the perception and prediction of the overall security situation of the power network by the network security vertical large model. The code example is shown in Figure 3 .

[0075] In this embodiment, the specific process of analyzing and constructing attack chains and generating power network security situation and risk assessment reports is as follows: based on the above analysis, first, the correlation between attacks is automatically generated and embedded by algorithm, that is, the same source (multiple attacks initiated by the same IP or source) and the same type (different sources but similar attack patterns) of events are classified and integrated, and by embedding the causal relationship and time sequence relationship structure field (such as "previous_event_id" and "next_event_id") into the integrated same source or same type event objects, the internal time sequence relationship or logical relationship of the same source or same type events is associated, and the integrated event object code example is shown in Figure 4 .

[0076] Subsequently, based on the threat event objects that have completed integration and relationship structure embedding, the network security vertical large model is further used to analyze the time sequence information and potential causal relationship of the same source or same type event objects, automatically generate complete attack chains, and accurately describe the association and evolution path between events. At the same time, in the process of generating attack chains, the network security vertical large model further assesses the risk of the entire chain according to the length of the attack chain, the complexity of the attack, the value of the target asset and its potential impact of the multi-dimensional factors, and gives a risk level assessment result of low, medium, high and extremely high four levels, to help the security team to respond to high-risk events first. Based on the above analysis results, the network security vertical large model automatically generates a structured network security situation report according to the instructions, which includes detailed description of the attack chain, key nodes, potential threat impact and risk level, to help the security team quickly understand the overall security situation and risk status of the network. The code example of the power network security situation report is shown in Figure 5 .

[0077] In this embodiment, the specific process of power network security situation prediction and protection strategy suggestion generation is as follows: first, based on historical attack chain data and known threat behaviors, a security situation knowledge base containing different types of attack chain patterns, development paths and protection strategies is constructed, and the content of the knowledge base is continuously updated as new attack patterns appear, to ensure that it can provide accurate knowledge support for the large model. Subsequently, the network security vertical large model matches the current attack chain with the attack patterns in the knowledge base through the RAG technology according to the situation report content generated in step 2, and combines the matched knowledge base content for context understanding and reasoning analysis to predict the potential development direction of the attack chain and the possible next action.

[0078] In this embodiment, the protection strategy includes: the effective protection strategy proposed by the network security expert according to the existing attack chain and the protection strategy for the related attack behavior in the existing network security knowledge base.

[0079] On this basis, the network security vertical large model will further automatically generate early warning information and corresponding protection suggestions based on the protection strategies in the knowledge base, such as enabling multi-factor authentication, strengthening sensitive data access monitoring, limiting specific IP access, etc. The above early warning information and strategy suggestions are output in a structured JSON format, ensuring content standardization and easy integration, thereby helping the security team to more efficiently respond to potential threats and improve protection effectiveness. The code example of the output of the network security vertical large model for power network security situation prediction is shown in Figure 6

[0080] For the power network security situation awareness and risk assessment task, part of the mixed data set containing normal operation and abnormal behavior is collected from the network traffic data, system logs and user behavior data in the actual operation environment of the power network system to evaluate the effectiveness of the method. Considering that the large model not only needs to accurately identify the attack event chain in the power network security situation awareness and risk assessment task, but also needs to propose correct countermeasures for potential attack behaviors, we use accuracy and cosine similarity as indicators for evaluation. Cosine similarity is mainly used to evaluate the similarity between the countermeasures proposed by the network security large model for attack behaviors and the standard countermeasures, so as to reflect the correctness of the countermeasures proposed by the large model. The evaluation results are shown in Table 1. The accuracy of the network security vertical large model + correlation analysis + RAG method has been significantly improved, and the comparison results of cosine similarity also show that the invention can propose relatively correct countermeasures for the attack behaviors identified from the network system.

[0081] Table 1 Evaluation of power network security situation awareness and risk assessment task

[0082] ​

[0083] In summary, the method does not rely on predefined rules, but automatically learns deep features and semantic associations of attacks on a large amount of multi-modal data through pre-training, captures potential patterns and associations of attack behaviors in complex scenarios, and therefore even if zero-day attacks or variant attacks do not appear in the training data, the model can infer whether there is a potential threat based on similar behavior features or abnormal log information, and further provide corresponding explainable decisions, thereby improving the reliability of network security situation awareness.

[0084] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network risk assessment method based on a pre-training model of multi-modal data, characterized in that, The method is based on a pre-trained and fine-tuned network security vertical large model, and uses correlation analysis technology and RAG technology to evaluate network risks, and the method steps include: S1, collect multi-source network security data, preprocess and semanticize the data, and establish a correlation between events in the network security data; S2, based on the network security vertical large model, identify the threat event objects in the network security data, and based on the established correlation, connect the threat event objects into multiple complete attack chains, further analyze to extract the feature information and main attack nodes of each attack chain; S3, according to the feature information of each attack chain, based on the network security vertical large model, evaluate and generate the risk level information of the attack chain; S4, integrate the feature information, main attack nodes and risk level information of the attack chain to generate and continuously record the network security situation report; S5, based on historical attack chain data and known threat behaviors, pre-construct a network security situation knowledge base covering different attack chain modes, development paths and protection strategies; S6, based on the network security vertical large model, match and compare the feature information of the attack chain with the attack chain data in the network security situation knowledge base, predict potential threat impacts, and generate early warning information and protection strategy suggestions.

2. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The pre-training of the pre-trained and fine-tuned network security vertical large model is to train the base large language model of InternLM2.5-7B using network security related corpus, and the fine-tuning is to fine-tune the pre-trained large model using network security related question and answer pairs, so that it has the reasoning ability to answer network security questions.

3. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The sources of the multi-source network security data in S1 include network logs, traffic data and user behavior records, and the preprocessing includes cleaning, denoising and format conversion of the multi-source network security data.

4. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The correlation between events in the network security data in S1 is established according to source, category, time sequence and logical relationship.

5. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, In S2, the threat event objects are identified to extract key threat elements, which are then converted into standard JSON format event objects; the key threat elements include event ID, timestamp, threat source, threat type, impact range, event description and confidence.

6. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The feature information in S2 includes the length of the attack chain, the node attack content, the attack complexity and the asset value of the attack target.

7. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The specific steps of evaluating and generating the risk level information of the attack chain in S3 are as follows: using the pre-trained and fine-tuned network security vertical large model, according to the feature information of each attack chain, evaluating the risk of the corresponding attack chain, and giving the risk level evaluation result to help the security team respond to high-risk events first; The risk level evaluation result includes four levels: low, medium, high and very high.

8. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The protection strategies in S5 include effective protection strategies proposed by network security experts based on existing attack chains and protection strategies for related attack behaviors in the existing network security knowledge base.

9. The network risk assessment method based on a pre-training model of multi-modal data according to claim 1, characterized in that, The S6 is specifically configured to match and compare the attack chain in the current report with the attack chain in the network security situation knowledge base by using the RAG technology. 10.A network risk assessment system based on a pre-trained model of multi-modal data, characterized in that, The system works by applying the network risk assessment method based on the multi-modal data pre-training model according to any one of claims 1-9, and the system comprises a data acquisition and preprocessing module, a risk assessment module, a situation report and knowledge base construction module, and a warning and strategy suggestion module. The data acquisition and preprocessing module is configured to acquire multi-source network security data, perform data preprocessing and semantic processing, and identify threat event objects. The attack chain construction module is configured to establish associations between the threat event objects, connect them into multiple complete attack chains, and analyze the characteristic information and main attack nodes of each attack chain. The risk assessment module is configured to assess and generate the risk level of each attack chain according to the characteristic information of each attack chain. The situation report and knowledge base construction module is configured to integrate the characteristic information, main attack nodes and risk level information of the attack chains, generate and continuously record network security situation reports, and pre-construct a network security situation knowledge base covering different attack chain modes, development paths and protection strategies based on historical attack chain data and known threat behaviors. The warning and strategy suggestion module is configured to match and compare the characteristic information of the attack chains with the attack chain data in the network security situation knowledge base, predict potential threat impacts, and generate warning information and protection strategy suggestions.

Images