Network security intelligent number asking method and system based on generative large model

Abstract

The invention discloses a network security intelligent number asking method and system based on a generative large model, and relates to the technical field of network security intelligence, and the method comprises the steps: collecting network security data, and carrying out the preprocessing of the network security data; training a generative large model by using the preprocessed network security data, introducing transfer learning in the training process, and adjusting model parameters and structure; constructing an intelligent question-answering system, receiving questions input by a user based on the trained generative large model and generating answers, processing multimedia information by adopting a multi-modal information fusion technology, and optimizing the system according to user feedback; an adversarial sample is generated through an adversarial training technology to simulate a real network attack and defense scene, the performance of the intelligent question-answering system is evaluated, and the model is periodically updated and maintained. According to the invention, the application field of the intelligent question-answering system is expanded, and a more comprehensive and intelligent solution is provided for the fields of network security education, training and the like.

Description

Technical Field

[0001] The present invention relates to the field of network security intelligent technology, and in particular to a network security intelligent questioning method and system based on a generative large model. Background Art

[0002] At present, with the continuous development and popularization of network technology, network security issues are becoming increasingly prominent. Traditional network security protection methods have been unable to cope with increasingly complex and diverse network attack methods. Therefore, a more intelligent and efficient network security protection method is needed to solve this problem. Generative big models, as an emerging artificial intelligence technology, have powerful learning and reasoning capabilities, and provide new ideas and methods for intelligent protection in the field of network security. Summary of the invention

[0003] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a network security intelligent questioning method and system based on a generative large model, which can solve the problems mentioned in the background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a network security intelligent questioning method based on a generative large model, which includes collecting network security data and preprocessing the network security data;

[0008] Use preprocessed cybersecurity data to train a large generative model, introduce transfer learning during the training process, and adjust model parameters and structure;

[0009] Build an intelligent question-answering system that receives user input questions and generates answers based on a trained generative large model, uses multimodal information fusion technology to process multimedia information, and optimizes the system based on user feedback;

[0010] Adversarial samples are generated through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

[0011] As a preferred solution of the network security intelligent questioning method based on the generative large model described in the present invention, wherein: the network security data includes network logs, attack patterns, defense strategies, user behavior data and vulnerability information;

[0012] The preprocessing includes cleaning, denoising, formatting and data enhancement;

[0013] The data enhancement includes data amplification and data transformation. The data amplification is achieved through random cropping, rotation, and flipping operations, and the data transformation is achieved through PCA dimensionality reduction and feature selection methods.

[0014] As a preferred solution of the network security intelligent questioning method based on the generative large model described in the present invention, wherein: the transfer learning includes:

[0015] Pre-trained models are used to accelerate the training process of large generative models and optimize model parameters and structure. The pre-trained models include ImageNet and Wikipedia.

[0016] As a preferred solution of the network security intelligent questioning method based on the generative large model described in the present invention, wherein: the multimedia information includes multimedia information composed of text, image and audio;

[0017] The multimodal information fusion technology is implemented through a deep neural network architecture, including a multimodal Transformer model.

[0018] As a preferred solution of the network security intelligent questioning method based on the generative large model described in the present invention, the generation of adversarial samples through adversarial training technology includes generating adversarial samples by applying small perturbations to the original samples.

[0019] As a preferred solution of the network security intelligent numerical method based on the generative large model described in the present invention, the regular updating and maintenance of the model includes receiving data and performing update optimization through automatic updating and online learning technology.

[0020] As a preferred solution of the network security intelligent question-answering method based on the generative large model described in the present invention, the intelligent question-answering system is used to be integrated into the network security monitoring and management system, and the intelligent question-answering system is combined with real-time log analysis and threat intelligence platform.

[0021] In a second aspect, the present invention provides a network security intelligent question-answering system based on a generative large model, which includes: a data collection and preprocessing module, a model training module, an intelligent question-answering module, and an update and maintenance module;

[0022] The data collection and preprocessing module is used to collect network security data and preprocess the network security data;

[0023] The model training module is used to train the generative large model using the preprocessed network security data, introduce transfer learning during the training process, and adjust the model parameters and structure;

[0024] The intelligent question-answering module is used to build an intelligent question-answering system, which receives questions input by users and generates answers based on the trained generative large model, processes multimedia information using multimodal information fusion technology, and optimizes the system based on user feedback;

[0025] The update and maintenance module is used to generate adversarial samples through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

[0026] In a third aspect, the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the processor executes the computer program, the steps of a network security intelligent questioning method based on a generative large model are implemented.

[0027] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, the steps of a network security intelligent questioning method based on a generative large model are implemented.

[0028] Compared with the existing technology, the beneficial effects of the present invention are: improving the accuracy and efficiency of network security questions and answers, providing network security administrators with more convenient and intelligent services; enhancing the robustness and anti-attack capabilities of the model through attack and defense confrontation simulation and verification, and improving the reliability and stability of network security protection; achieving continuous updating and maintenance, so that the model can adapt to new changes and new demands in the field of network security, maintaining the advancement and practicality of the technology; expanding the application field of the intelligent question and answer system, and providing more comprehensive and intelligent solutions for fields such as network security education and training. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A method flow chart of a network security intelligent questioning method and system based on a generative large model provided by an embodiment of the present invention;

[0031] Figure 2 An internal structure diagram of a computer device of a network security intelligent query method and system based on a generative large model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the above-mentioned purposes, features and advantages of the present invention more understandable, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0033] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0034] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0035] Example 1, reference Figure 1-Figure 2 , which is the first embodiment of the present invention, and provides a network security intelligent questioning method based on a generative large model, comprising:

[0036] This application provides a method that can effectively solve the above-mentioned problems. Next, we will combine multiple embodiments to explain in detail how to implement the network security intelligent questioning method based on the generative large model;

[0037] Figure 1 A method flow chart of a network security intelligent questioning method and system based on a generative large model is shown, including:

[0038] S1: Collect network security data and pre-process the network security data;

[0039] Furthermore, network security data includes network logs, attack patterns, defense strategies, user behavior data, and vulnerability information;

[0040] Preprocessing includes cleaning, denoising, formatting, and data enhancement;

[0041] Data enhancement includes data amplification and data transformation. The data amplification is achieved through random cropping, rotation, and flipping operations, and the data transformation is achieved through PCA dimensionality reduction and feature selection methods. Data enhancement technology is used to further enrich the data set and improve the generalization ability of the model. Data enhancement technology can generate new data samples by performing certain transformations or combinations on the original data. Data amplification technology generates new data samples by copying, rotating, scaling, and other operations on the original data; and data transformation technology extracts features, reduces dimensions, or converts data to make the data more in line with the training requirements of the model. These technologies not only increase the diversity and complexity of the data set, but also help improve the training effect of the model, enabling it to better cope with various complex network security issues.

[0042] S2: Use the preprocessed cybersecurity data to train a generative large model, introduce transfer learning during the training process, and adjust the model parameters and structure;

[0043] Furthermore, transfer learning includes:

[0044] Pre-trained models are used to accelerate the training process of large generative models and optimize model parameters and structure. The pre-trained models include ImageNet and Wiki. Transfer learning technology is introduced. Transfer learning technology can use models that have been trained in other fields as pre-trained models to accelerate the current training process. Through transfer learning, the model can adapt to new tasks and data sets more quickly, thereby saving a lot of training time and computing resources. In addition, during the training process, the parameters and structure of the model are carefully adjusted to ensure the best performance of the model in network security question-answering tasks. These adjustments include adjusting the number of layers, number of neurons, activation functions, etc. of the model, as well as introducing regularization, dropout and other technologies to prevent overfitting.

[0045] S3: Build an intelligent question-answering system that receives user input questions and generates answers based on a trained generative large model, uses multimodal information fusion technology to process multimedia information, and optimizes the system based on user feedback;

[0046] Furthermore, multimedia information includes multimedia information consisting of text, images and audio;

[0047] The multimodal information fusion technology is used to process information through a deep neural network architecture, including a multimodal Transformer model. This technology can fully utilize the complementarity between various types of information such as text, images, and audio to provide a deeper and more comprehensive understanding of complex issues. For example, for a description of a cyber attack that includes an image, the system can automatically extract key information from the image and conduct a comprehensive analysis in combination with the text information to generate a more accurate and comprehensive answer. In addition, the system also has the ability to understand context and can generate more coherent and logical answers based on the user's historical questions and answers.

[0048] S4: Generate adversarial samples through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

[0049] Furthermore, generating adversarial samples through adversarial training techniques includes generating adversarial samples by applying small perturbations to original samples.

[0050] Furthermore, in the attack and defense simulation and verification stage, the present invention comprehensively evaluates and optimizes the performance of the intelligent question-answering system by simulating real network attack and defense scenarios. In order to enhance the robustness and anti-attack ability of the model, adversarial training technology is introduced. This technology generates adversarial samples and trains the model to enable it to learn more robust features and representations. Adversarial samples are generated by adding tiny disturbances to the original data. Although these disturbances do not affect human perception, they can cause the model to make incorrect predictions. By training the model to identify and respond to these adversarial samples, the robustness and anti-attack ability of the model can be significantly improved. In addition, key indicators such as the system's response time and accuracy are tested in detail to ensure the stability and reliability of the system in practical applications.

[0051] Furthermore, regularly updating and maintaining the model includes receiving data and updating and optimizing it through automated updates and online learning technologies. The use of automated updates and online learning technologies enables the model to receive new data and feedback in real time and automatically update and optimize. This mechanism ensures that the model is always up to date and can adapt to new changes and new needs in the field of network security. Automated updates and online learning technologies not only improve the flexibility and adaptability of the model, but also reduce maintenance costs. In addition, comprehensive security audits and performance tests are regularly conducted on the system to discover and fix possible vulnerabilities and defects. These measures not only improve the security and stability of the system, but also provide users with more reliable and efficient network security question and answer services.

[0052] Furthermore, the intelligent question-and-answer system is used to be integrated into the network security monitoring and management system, and the intelligent question-and-answer system combines real-time log analysis and threat intelligence platform. The intelligent question-and-answer system is applied to the field of network security education and training to provide students with personalized learning resources and guidance. Through the question-and-answer service provided by the intelligent question-and-answer system, students can quickly acquire the required knowledge and skills, and conduct targeted learning and practice according to their actual situation. This application can further improve the effect and quality of network security education and training, and contribute to the cultivation of more network security professionals.

[0053] Furthermore, this embodiment also provides a network security intelligent question-answering system based on a generative large model, including: a data collection and preprocessing module, a model training module, an intelligent question-answering module, and an update and maintenance module;

[0054] The data collection and preprocessing module is used to collect network security data and preprocess the network security data;

[0055] The model training module is used to train the generative large model using the preprocessed network security data, introduce transfer learning during the training process, and adjust the model parameters and structure;

[0056] The intelligent question-answering module is used to build an intelligent question-answering system, which receives questions input by users and generates answers based on the trained generative large model, processes multimedia information using multimodal information fusion technology, and optimizes the system based on user feedback;

[0057] The update and maintenance module is used to generate adversarial samples through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

[0058] This embodiment also provides a computer device, which may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 2As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a network security intelligent questioning method based on a generative large model is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse, etc.

[0059] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which implements the following steps when the computer program is executed by a processor: collecting network security data and preprocessing the network security data;

[0060] Use preprocessed cybersecurity data to train a large generative model, introduce transfer learning during the training process, and adjust model parameters and structure;

[0061] Build an intelligent question-answering system that receives user input questions and generates answers based on a trained generative large model, uses multimodal information fusion technology to process multimedia information, and optimizes the system based on user feedback;

[0062] Adversarial samples are generated through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

[0063] Example 2, reference Figure 1 - Figure 2 , which is the second embodiment of the present invention, and this embodiment provides a network security intelligent questioning method based on a generative large model. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0064] In order to verify the effectiveness of the network security intelligent question-and-answer method based on the generative large model in actual application scenarios, a medium-sized enterprise-level network environment was selected as the experimental object. The enterprise's network system includes an internal LAN, a server cluster, and an external Internet connection. It processes about 100,000 network requests per day and stores a large amount of sensitive data.

[0065] We collected network logs, attack pattern records, defense strategy documents, and user behavior data from the past six months. The total amount of data is about 2TB.

[0066] The collected data were cleaned to remove duplicates, invalid information and noise to ensure the consistency and accuracy of the data.

[0067] Data augmentation techniques were applied, such as amplifying image data through random cropping, rotation, and other operations; PCA dimensionality reduction and feature selection methods were used to optimize text data, thereby enriching the training data set.

[0068] The preprocessed dataset is used to train a large generative model. A pre-trained model based on the Transformer architecture, such as BERT or GPT series, is selected and fine-tuned to adapt to tasks specific to the field of network security.

[0069] During the training process, model parameters such as learning rate and batch size were adjusted, and transfer learning technology was introduced to use large-scale pre-trained models from ImageNet and Wikipedia to accelerate the training process and improve model performance.

[0070] Based on the trained generative big model, an intelligent question-answering system was built that can receive and respond to questions about network security and supports text, image, and audio input.

[0071] The system uses multimodal information fusion technology to integrate different types of media information, improving the accuracy and comprehensiveness of answers.

[0072] A user feedback mechanism is integrated to enable continuous optimization based on actual usage.

[0073] A variety of real network attack scenarios were simulated, including DDoS attacks, SQL injection attacks, etc., and adversarial samples were generated to test the robustness of the model.

[0074] Use automated updates and online learning techniques to enable systems to adapt to emerging threats in real time and conduct regular performance reviews.

[0075] Integrate the intelligent question-and-answer system into the existing network security monitoring platform to provide real-time security situation awareness and early warning services.

[0076] A one-month trial run was carried out within the enterprise, during which user feedback was collected and the system's functions and service quality were further improved.

[0077] Before the experiment began, all the above steps were planned and technical solutions were designed in detail. First, the data collection team worked with the company's IT department to ensure that the acquired data covered as wide a range of scenarios as possible. Next, data scientists were responsible for data preprocessing to ensure that the data quality met the needs of subsequent modeling. Subsequently, algorithm engineers focused on model selection and training, paying special attention to how to speed up training through transfer learning without losing accuracy. On this basis, the development team built an intelligent question-and-answer system and collaborated with security experts to ensure that the system can effectively respond to various network security issues. Finally, the operation and maintenance team deployed the system to the production environment and arranged dedicated technical support personnel to assist users in familiarizing themselves with the new tools. The entire experimental process strictly follows scientific methodology to ensure the authenticity and reliability of the results.

[0078] Table 1: Comparison of indicators before and after the experiment

[0079]

[0080]

[0081] Table 1 shows the changes in the main performance indicators of the method of the present invention before and after it is applied in an enterprise-level network environment. It can be seen that the average response time is greatly reduced, the accuracy of vulnerability detection is significantly improved, the efficiency of security incident processing is significantly enhanced, user satisfaction is also greatly improved, and the model update is more timely.

[0082] Table 2: Evaluation of adversarial training effect

[0083] Parameter name unit Pre-experimental value Post-experimental value Improvement ratio Remark Adversarial sample recognition rate ％ 65.4 88.2 22.8％ Significant improvement Attack resistance rating Points (out of 10 points) 5.6 8.3 26.8％ Significantly enhanced Model robustness score Points (out of 10 points) 6.1 8.7 26.2％ Significantly enhanced System stability score Points (out of 10 points) 6.8 9.1 19.1％ Significantly improved Running costs Yuan / month 15,000 14,500 -3.3％ Cost reduction Performance degradation threshold ％ 10.2 7.6 -25.5％ More stable

[0084] Table 2 focuses on the evaluation of the effect of adversarial training, which shows that after the introduction of adversarial training, the system has made significant progress in identifying adversarial samples, anti-attack capabilities and model robustness, while maintaining lower operating costs and higher performance stability.

[0085] It can be seen from the data in Table 1 that the method of the present invention has achieved significant improvements in multiple key performance indicators. Specifically, the average response time was shortened from the original 5.2 seconds to 1.8 seconds, a reduction of 65.4%, which not only improves the user experience, but also provides a guarantee for rapid response to potential security threats. The vulnerability detection accuracy increased from 78.9% to 92.3%, an increase of 13.4 percentage points, which means that more hidden security risks are discovered in a timely manner. In addition, the efficiency of security incident handling increased by 25.5% to 85.7%, indicating that the system can respond to emergencies more efficiently. The user satisfaction score increased from 6.5 to 8.9, reflecting a significant increase in user recognition of the new system. More importantly, the model update frequency increased from once a month to three times, ensuring that the system is always in the best condition and adapts to the ever-changing security environment.

[0086] Table 2 further confirms the positive impact of adversarial training on enhancing system security. The recognition rate of adversarial samples increased by 22.8% to 88.2%, indicating that the model after adversarial training is more resistant to malicious attacks. The scores of anti-attack capability and model robustness increased by 26.8% and 26.2% respectively, reflecting the stable performance of the system in a complex network environment. It is worth noting that despite the enhanced security protection measures, the overall operating cost has been reduced by 3.3%, proving the economic advantage of the method of the present invention. The performance degradation threshold has also dropped from 10.2% to 7.6%, indicating that the system still maintains good performance when facing high loads.

[0087] In summary, the method of the present invention demonstrates outstanding innovation and practicality in an enterprise-level network environment. Compared with the prior art, it not only improves the efficiency and accuracy of network security management, but also effectively reduces operating costs and enhances the robustness and anti-attack capabilities of the system. These advantages make the method of the present invention an ideal choice for solving current network security challenges, and it has important academic value and practical application prospects.

[0088] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0089] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0090] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0091] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0092] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0093] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0094] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security intelligent questioning method based on a generative large model, characterized by: include, Collecting network security data and preprocessing the network security data; Use preprocessed cybersecurity data to train a large generative model, introduce transfer learning during the training process, and adjust model parameters and structure; Build an intelligent question-answering system that receives user input questions and generates answers based on a trained generative large model, uses multimodal information fusion technology to process multimedia information, and optimizes the system based on user feedback; Adversarial samples are generated through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

2. The network security intelligent questioning method based on the generative large model as claimed in claim 1 is characterized by: The network security data includes network logs, attack patterns, defense strategies, user behavior data and vulnerability information; The preprocessing includes cleaning, denoising, formatting and data enhancement; The data enhancement includes data amplification and data transformation. The data amplification is achieved through random cropping, rotation, and flipping operations, and the data transformation is achieved through PCA dimensionality reduction and feature selection methods.

3. The network security intelligent questioning method based on the generative large model as claimed in claim 2 is characterized by: The transfer learning includes: Pre-trained models are used to accelerate the training process of large generative models and optimize model parameters and structure. The pre-trained models include ImageNet and Wikipedia.

4. The network security intelligent questioning method based on the generative large model as claimed in claim 3 is characterized by: The multimedia information includes multimedia information consisting of text, images and audio; The multimodal information fusion technology is implemented through a deep neural network architecture, including a multimodal Transformer model.

5. The network security intelligent questioning method based on the generative large model as claimed in claim 4 is characterized by: The generating of adversarial samples by adversarial training technology includes generating adversarial samples by applying slight perturbations to original samples.

6. The network security intelligent questioning method based on the generative large model as claimed in claim 5 is characterized by: The periodic updating and maintenance model includes receiving data and performing updating and optimization through automatic updating and online learning technology.

7. The network security intelligent questioning method based on the generative large model as claimed in claim 6 is characterized by: The intelligent question-answering system is used to be integrated into a network security monitoring and management system, and the intelligent question-answering system combines real-time log analysis and a threat intelligence platform.

8. A network security intelligent questioning system based on a generative large model, based on the network security intelligent questioning method based on a generative large model according to any one of claims 1 to 7, characterized in that: It includes data collection and preprocessing module, model training module, intelligent question and answer module and update and maintenance module; The data collection and preprocessing module is used to collect network security data and preprocess the network security data; The model training module is used to train the generative large model using the preprocessed network security data, introduce transfer learning during the training process, and adjust the model parameters and structure; The intelligent question-answering module is used to build an intelligent question-answering system, which receives questions input by users and generates answers based on the trained generative large model, processes multimedia information using multimodal information fusion technology, and optimizes the system based on user feedback; The update and maintenance module is used to generate adversarial samples through adversarial training technology to simulate real network attack and defense scenarios, evaluate the performance of the intelligent question-answering system, and regularly update and maintain the model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security intelligent questioning method based on the generative large model according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security intelligent questioning method based on a generative large model according to any one of claims 1 to 7 are implemented.

Images