Generative large model-based power network security intelligent consultation system

Abstract

The invention discloses a power network security intelligent consultation system based on a generative large model, and relates to the technical field of network security consultation systems, and the system comprises a consultation question and answer function module which comprises a technology consultation unit, an attack and defense research and judgment unit, and a protection disposal suggestion unit; according to the generative large model, statistical relationships and modes in text data are found based on a deep learning method and training of a large-scale corpus, and in the training process, the model learns and generates new data samples to establish a network security knowledge base; and the network security knowledge base provides data support for the technical consultation unit, the attack and defense research and judgment unit and the protection disposal suggestion unit. The whole question and answer consultation process of the system depends on an advanced deep learning model and algorithm in a generative large model, it is ensured that the system can automatically and accurately answer various network security field problems proposed by users, and timely and professional consultation services are provided.

Description

Technical Field

[0001] The present invention relates to the technical field of network security consulting systems, and in particular to an intelligent consulting system for power network security based on a generative large model. Background Art

[0002] With the deepening of the digital transformation of power systems, cybersecurity threats have shown the characteristics of diversified attack methods, complex attack chains, and precise attack targets. Traditional rule-matching-based network security protection methods mainly rely on preset security policies and feature libraries. When facing new attacks, there are problems such as detection lag and high false alarm rate. Although the network security solution based on large models has improved the security analysis capability by introducing deep learning technology, how to achieve accurate understanding and rapid response of security knowledge in the complex industrial environment of power networks is still a challenge.

[0003] At present, there are the following technical problems in power network security: First, the efficiency of security event correlation analysis is low. The existing system is difficult to effectively capture the potential correlation between cross-domain security events, resulting in insufficient accuracy in threat tracing and impact assessment; second, the intelligence level of security analysis is not high, lacking the ability to deeply mine massive security logs and historical data, and unable to timely discover potential security risks; third, the application efficiency of security knowledge is low. The existing system fails to provide accurate security consulting services based on the needs of different user roles, affecting the overall effect of security operations. How to build a system that can improve the efficiency of network security monitoring and analysis and realize intelligent security management has become a key issue that needs to be solved urgently. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the present invention provides an intelligent consulting system for power network security based on a generative large model, which can solve the problems mentioned in the background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: an intelligent consulting system for power network security based on a generative large model, comprising: a consulting question and answer function module, the consulting question and answer function module comprising a technical consulting unit, an attack and defense analysis unit, and a protection and disposal suggestion unit;

[0007] A generative big model, which is based on deep learning methods and large-scale corpus training to discover statistical relationships and patterns in text data. During the training process, the model will learn to generate new data samples to establish a network security knowledge base. The network security knowledge base provides data support for the technical consulting unit, the attack and defense analysis unit, and the protection and disposal recommendation unit. The consultation question and answer function module is based on the network security knowledge base in the generative big model to understand and answer the power network security issues raised by users.

[0008] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the generative large model includes:

[0009] A deep neural network architecture unit that captures the semantic relationship of input text through self-attention mechanism;

[0010] Pre-training unit, used for pre-training on the corpus in the field of power network security;

[0011] A fine-tuning unit, used to adjust the parameters of the pre-trained model for a specific security consulting task;

[0012] The vector representation unit is used to convert professional vocabulary in the security field into representation in a high-dimensional vector space.

[0013] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the dialogue processing process of the generative large model includes:

[0014] Get the historical conversation records of the current session;

[0015] Extract key information and context from the conversation;

[0016] Semantically understand the current input based on contextual information;

[0017] If the context is detected to be relevant, the historical information is incorporated into the response generation process; otherwise, the response is generated based only on the current input.

[0018] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the response generation process of the generative large model includes:

[0019] Identify professional terms in the security field for input questions;

[0020] Select the corresponding knowledge base retrieval strategy based on the question type;

[0021] Extract relevant information from the knowledge base;

[0022] If the completeness of the extracted information exceeds the preset threshold, a response is generated directly; otherwise, a response is generated after supplementing the necessary information through knowledge reasoning.

[0023] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the users covered by the consulting question and answer function module include security decision makers, security operators and ordinary personnel, and the processing of different user roles includes:

[0024] If a person is identified as a security decision-maker, the security situation screen data is obtained and updated at preset time intervals. At the same time, a risk warning index is generated based on statistical analysis of historical security events.

[0025] If identified as a security operator, they will receive real-time security logs and conduct event tracing analysis based on preset association rules;

[0026] If the person is identified as an ordinary person, their historical access records will be obtained and personalized security knowledge content will be recommended based on the user portrait.

[0027] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the data processing process of the security decision maker includes:

[0028] If an abnormal risk warning is received, relevant security event information will be automatically aggregated and the emergency response process will be triggered;

[0029] If the security situation score is detected to be lower than the first preset threshold, the security reinforcement strategy is initiated and a special protection recommendation report is generated;

[0030] If the frequency of a certain type of security incident is found to exceed the second preset threshold, the protection strategy weight of this type of incident will be automatically adjusted and the detection rules will be optimized.

[0031] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the event analysis process of the security operator includes:

[0032] If a security event with unknown characteristics is detected, the similarity between its feature vector and the historical events in the knowledge base is calculated;

[0033] If the similarity exceeds a third preset threshold, the event is classified into the most similar known event type and the feature library is updated;

[0034] If the similarity is lower than the fourth preset threshold, a new event type is created, and the deep analysis process is triggered at the same time to expand the feature library through multi-dimensional feature extraction.

[0035] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, the knowledge push process of the ordinary personnel includes:

[0036] If the user queries a certain security knowledge point, the pre-knowledge dependency of the knowledge point is analyzed;

[0037] If necessary prerequisite knowledge exists, the learning content of the prerequisite knowledge will be pushed first;

[0038] If the user's query frequency in a specific knowledge field exceeds the fifth preset threshold, a deep learning path for that field is automatically generated.

[0039] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, it also includes an intelligent homepage module, and the personalized processing process of the intelligent homepage module includes:

[0040] If the security knowledge points that the user has recently visited are related, a knowledge graph will be automatically constructed and displayed according to the strength of the association between the knowledge points;

[0041] If it is detected that the user's attention to a certain type of security incident exceeds the sixth preset threshold, the latest developments and protection suggestions for this type of incident will be pushed first;

[0042] If the user's access pattern shows regularity in a specific time period, preload related content to improve response speed.

[0043] As a preferred solution of the power network security intelligent consulting system based on the generative large model described in the present invention, it also includes an intelligent homepage module, and the personalized processing process of the intelligent homepage module includes:

[0044] If the security knowledge points that the user has recently visited are related, a knowledge graph will be automatically constructed and displayed according to the strength of the association between the knowledge points;

[0045] If it is detected that the user's attention to a certain type of security incident exceeds the sixth preset threshold, the latest developments and protection suggestions for this type of incident will be pushed first;

[0046] If the user's access pattern shows regularity in a specific time period, preload related content to improve response speed.

[0047] Beneficial effects of the invention: The entire question-and-answer consultation process of the system will rely on advanced deep learning models and algorithms in the generative large model to ensure that the system can automatically and accurately answer various network security questions raised by users and provide timely and professional consulting services. This technical route integrates a variety of advanced technologies such as deep learning, knowledge reasoning and association analysis, aiming to build an efficient and intelligent network security question-and-answer consultation system to meet the needs of users in the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0049] Figure 1 This is a schematic diagram of the overall structure of an intelligent consulting system for power network security based on a generative large model proposed by the present invention. DETAILED DESCRIPTION

[0050] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0051] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0052] Example 1, reference Figure 1 , which is an embodiment of the present invention, provides an intelligent consulting system for power network security based on a generative large model.

[0053] A generative big model refers to a generative model based on a large-scale corpus. It is usually trained and generated in a manner similar to an autoregressive model. It can generate, understand and reason about natural language in an end-to-end manner. It usually includes models such as Transformer, GPT, GPT-2, and GPT-3. The power network security intelligent consulting system is an intelligent solution designed for power system network information security issues. By applying the generative big model to the power network security intelligent consulting system, a consulting system with high intelligence and adaptability can be constructed. The system can use the natural language processing capabilities of the generative big model to intelligently analyze and diagnose security issues in the power network, while providing targeted solutions and suggestions.

[0054] In the power system, network security is of vital importance. Since the power system involves a large amount of sensitive data and key information, once it suffers a network attack or data leakage, it may cause serious consequences. Therefore, the power network security intelligent consulting system using generative large models can provide strong protection and support for the network security of the power system.

[0055] The present invention provides an intelligent consulting system for power network security based on a generative large model, comprising a consulting question-answering function module and a generative large model.

[0056] The consultation and question-answering function module includes the technical consultation unit, the attack and defense judgment unit, and the protection and disposal suggestion unit. The generative big model discovers statistical relationships and patterns in text data based on deep learning methods and large-scale corpus training. During the training process, the model will learn to generate new data samples to establish a network security knowledge base. The network security knowledge base provides data support for the technical consultation unit, the attack and defense judgment unit, and the protection and disposal suggestion unit. The consultation and question-answering function module is based on the network security knowledge base in the generative big model to understand and answer the power network security issues raised by users.

[0057] The entire Q&A consultation process of the power network security intelligent consultation system based on the generative big model will rely on the advanced deep learning models and algorithms in the generative big model to ensure that the system can automatically and accurately answer various network security questions raised by users and provide timely and professional consulting services. This technical route integrates a variety of advanced technologies such as deep learning, knowledge reasoning and association analysis, aiming to build an efficient and intelligent network security Q&A consultation system to meet the needs of users in the field of network security.

[0058] Furthermore, the generative large model includes a deep neural network architecture unit, which is used to capture the semantic relationship of the input text through a self-attention mechanism; a pre-training unit, which is used to pre-train on a corpus in the field of power network security; a fine-tuning unit, which is used to adjust the parameters of the pre-trained model for specific security consulting tasks; and a vector representation unit, which is used to convert professional vocabulary in the security field into representations in a high-dimensional vector space.

[0059] The power network security intelligent consulting system based on generative big models can have the following functions: Intelligent identification and diagnosis, the system can automatically identify security vulnerabilities and potential threats in the power network, and conduct in-depth analysis and diagnosis of security incidents through generative big models to determine the root cause and nature of the problem. Intelligent consultation and advice, based on the analysis results, the system can provide targeted security consultation and advice to help users understand the severity and scope of security issues, while providing effective solutions and measures. Intelligent early warning and prevention, through real-time monitoring and analysis of security data in the power network, the system can promptly detect potential security risks and issue early warning signals in advance to help users take preventive measures to avoid security incidents. Continuous learning and optimization, the generative big model has the ability to continuously learn and optimize, and can continuously learn new knowledge and patterns from new security data to improve the accuracy and reliability of the system.

[0060] The dialogue processing process of the generative large model includes: obtaining the historical dialogue records of the current conversation; extracting key information and context in the dialogue; semantically understanding the current input based on the context information; if the context is detected to be relevant, incorporating the historical information into the response generation process; otherwise, generating a response based only on the current input.

[0061] The response generation process of the generative large model includes: identifying professional terms in the security field for input questions; selecting the corresponding knowledge base retrieval strategy based on the question type; extracting relevant information from the knowledge base; if the completeness of the extracted information exceeds the preset threshold, directly generating a response; otherwise, generating a response after supplementing the necessary information through knowledge reasoning.

[0062] The users covered by the consultation and question-and-answer function module include security decision-makers, security operators and ordinary personnel. The processing of different user roles includes: if identified as a security decision-maker, the security situation screen data is obtained and updated at preset time intervals, and a risk warning index is generated based on the statistical analysis of historical security events. If identified as a security operator, real-time security logs are received, and event tracing analysis is performed according to preset association rules; if identified as an ordinary person, their historical access records are obtained, and personalized security knowledge content is recommended based on user portraits.

[0063] The data processing process of security decision makers includes: if an abnormal risk warning is received, relevant security event information will be automatically aggregated and the emergency response process will be triggered; if the security situation score is detected to be lower than the first preset threshold, the security reinforcement strategy will be initiated and a special protection recommendation report will be generated; if the frequency of a certain type of security event is found to exceed the second preset threshold, the protection strategy weight of this type of event will be automatically adjusted and the detection rules will be optimized.

[0064] The event analysis process of security operators includes: if a security event with unknown characteristics is detected, the similarity between its feature vector and the historical events in the knowledge base is calculated; if the similarity exceeds the third preset threshold, the event is classified into the most similar known event type and the feature library is updated; if the similarity is lower than the fourth preset threshold, a new event type is created, and the deep analysis process is triggered at the same time to expand the feature library through multi-dimensional feature extraction.

[0065] The knowledge push process for ordinary personnel includes: if the user queries a certain security knowledge point, the prior knowledge dependency of the knowledge point is analyzed; if necessary prior knowledge exists, the learning content of the prior knowledge is pushed first; if the user's query frequency in a specific knowledge field exceeds the fifth preset threshold, a deep learning path for the field is automatically generated.

[0066] The personalized processing process of the smart homepage module includes: if the security knowledge points that the user has recently visited are related, a knowledge graph will be automatically constructed and displayed according to the strength of the correlation between the knowledge; if it is detected that the user's attention to a certain type of security incident exceeds the sixth preset threshold, the latest developments and protection suggestions for this type of incident will be pushed first; if the user's access pattern in a specific time period shows regularity, relevant content will be preloaded to improve response speed.

[0067] The collaborative processing of the technical consulting unit, the attack and defense analysis unit, and the protection and disposal suggestion unit includes:

[0068] If the technical consulting unit receives a security incident alert, it calls the attack and defense analysis unit to conduct a risk level assessment;

[0069] If the risk level assessed by the attack and defense assessment unit exceeds the first preset threshold, the protection disposal suggestion unit is triggered to generate an emergency disposal plan;

[0070] If the emergency response plan involves multiple security domains, the response steps are prioritized and conflicts are detected based on the knowledge reasoning capabilities of the generative big model.

[0071] In the above specific implementation, the generative big model deep learning model captures the complex patterns and semantic relationships in natural language and more accurately understands the questions raised by users. The generative big model successfully captures the complex patterns and semantic relationships in natural language through the comprehensive application of deep neural network architecture, pre-training and fine-tuning, core algorithms and technologies, and massive parameters and data.

[0072] Specifically: 1. Deep neural network architecture: Generative large models usually use deep neural network structures, such as Transformer, BERT, etc. These architectures use self-attention mechanisms to capture long-distance dependencies and semantic information in the input text. Each encoder and decoder is stacked by multiple identical layers, each of which contains a self-attention sublayer and a feedforward neural network sublayer. 2. Pre-training and fine-tuning: Pre-training, generative large models are pre-trained on a large amount of text data to learn the basic structure and semantics of the language. For example, BERT has learned a lot of language knowledge through pre-training tasks and has set records on multiple NLP tasks. Fine-tuning, for specific tasks, the pre-trained model is fine-tuned to meet the needs of different scenarios. During the fine-tuning process, the model parameters will be appropriately adjusted according to the task objectives to improve the performance on specific tasks. 3. Core algorithms and technologies: word embedding, deep learning models use word embedding technology to convert words into vectors in high-dimensional space, which can capture the semantics and contextual information of words. In this way, the model is able to understand the semantic relationships between words, such as similarity ("cat" and "dog" may be closer in vector space) and opposites. Sequence models, such as recurrent neural networks (RNNs) and long short-term memory networks (LSTMs), are able to handle the sequential nature of natural language. These models are able to capture long-distance dependencies in sentences, thereby better understanding the semantics of the entire sentence. Attention mechanism, the attention mechanism enables the model to focus on the most important parts when processing the input sequence. This mechanism is particularly important in the Transformer model, which helps the model capture key information more effectively when processing long texts, thereby improving the accuracy of semantic understanding. Multi-task learning, some models improve their semantic understanding ability by learning multiple related tasks at the same time. This approach enables the model to learn common and specific language features from different tasks, thereby improving its generalization ability. Graph neural network, when dealing with complex semantic relationships, graph neural networks can more effectively capture semantic dependencies by representing words and their relationships as graph structures. 4. Massive parameters and data: Generative large models usually have massive parameters, and through deep learning and training with large-scale data sets, they achieve in-depth understanding and efficient processing of language. These models are able to store and process more information, thereby more accurately capturing complex patterns and features in language.

[0073] Specifically, the generative large model maintains the conversation context and uses association analysis to improve the accuracy of question answering. Based on the conversation context, the generative large model analyzes and utilizes historical conversation information to better understand the user's current question and give a more accurate answer. The attention mechanism is an important tool for the generative large model when processing sequence data. It allows the model to focus on different parts of the input sequence when generating the current output, especially those parts that are most relevant to the current output. In a dialogue system, this means that the model can generate the current response based on specific information in the historical conversation, thereby maintaining the coherence and consistency of the conversation. In order to more effectively utilize historical conversation information, the generative large model adopts a hierarchical structure or memory network. The model can capture multi-level information in the conversation, such as the topic, emotion, style, etc. of the conversation, and comprehensively consider these factors when generating responses. During the training process, the generative large model will learn how to extract useful information from a large amount of conversation data and generate new conversation samples similar to the training data. In order to improve the model's ability to utilize historical conversation information, a variety of strategies are usually adopted during the training process, such as data enhancement, regularization, pre-training, etc. In addition, the performance of the model can be optimized by adjusting its parameters and structure, such as increasing the number of model layers, changing the implementation method of the attention mechanism, etc.

[0074] In the above specific implementation, the users covered by the consultation question and answer function module include security decision makers, security operations personnel and ordinary personnel.

[0075] Furthermore, security decision-makers can intuitively understand the security situation displayed on the large screen, and quickly obtain key security data through simple query question-and-answer queries, helping decision-makers to grasp the overall security situation. Network security decision-makers can intuitively understand the security situation displayed on the large screen, and quickly obtain key security data through simple query question-and-answer queries, helping decision-makers to efficiently grasp the overall security situation. The network security auxiliary analysis and decision-making system based on the generative big model will provide all-round decision-making support for security decision-makers, and has the following use value: Overall security overview: The system can comprehensively grasp and present the overall security status of the enterprise network through deep learning and analysis of the network environment. Real-time understanding of the network security risk level, as well as the frequency and handling of various security incidents, helps decision-makers to grasp the network security situation in real time, and helps to timely discover and respond to security risks. Security event overview: The system can collect, analyze and organize various security events in real time, including attack events, risk events, security threats, etc., and intelligently classify and sort these events, providing decision-makers with detailed security event reports, which helps decision-makers to fully understand and handle security events. Attacker profile: Through deep learning and analysis of attackers' behavior patterns, the system can clearly depict the characteristics and behavior patterns of attackers, help decision makers understand attackers' attack strategies and methods, and provide strong decision-making support for preventing attacks. Security operation report: The system can automatically generate detailed security operation reports based on various types of collected data, including security threat analysis, security incident handling reports, security risk warnings, etc., to provide decision makers with comprehensive and in-depth security operation data support, which helps decision makers make accurate and effective security decisions. In general, the network security auxiliary analysis and decision-making system based on generative big models can provide decision makers with comprehensive, accurate, and real-time network security situation reports and decision-making recommendations through deep learning and big data analysis, effectively improving the accuracy and efficiency of network security decisions.

[0076] Furthermore, security operators can use this module to conduct in-depth queries on security events and security logs. By inputting a query, the system can intelligently analyze and return specific results, improving the accuracy and timeliness of security analysis. Network security operators can use this module to conduct in-depth queries on security events and security logs. By inputting a query, the system can intelligently analyze and return specific results, improving the accuracy and timeliness of security analysis. The network security auxiliary analysis and decision-making system based on generative big models provides security operators with a series of functions, improving the efficiency and accuracy of network security defense.

[0077] First, the system has intelligent analysis functions. Through the big model technology, the system can automatically identify and analyze network security events, including correlation analysis of risk assets, attackers, security events, etc., to provide operators with comprehensive and in-depth information to help them understand and predict network security threats. Secondly, the system provides auxiliary judgment functions. For the submitted security samples, the system can automatically analyze whether they are attack payloads or malicious code samples, and provide relevant security suggestions. This greatly improves the work efficiency of operators and the accuracy of network security protection. Thirdly, the system realizes intelligent disposal functions. According to the intelligent analysis and judgment results of the big model, the system can automatically transmit security instructions to the border network security equipment to achieve linkage blocking or trapping and hunting of network attacks, and improve the real-time and effectiveness of network security protection. Finally, the system provides summary analysis and intelligent question and answer functions. Operators can obtain information such as overall security profile, security event profile, attacker profile, and intelligent question and answer content such as laws and regulations, company rules and regulations, and network security knowledge through the system, which improves the professional knowledge and operational efficiency of operators. In general, the network security auxiliary analysis and decision-making system based on generative big models provides powerful intelligent tools for security operators, which not only improves the efficiency and accuracy of network security protection, but also provides support for the professional development of operators, and has great practical value.

[0078] Furthermore, when ordinary personnel users input network security related questions, the system will provide comprehensive answers including laws, regulations, rules and regulations, network security knowledge, and security product knowledge. For ordinary personnel, this module provides an interactive consultation platform. Users can input network security related questions, and the system will provide comprehensive answers including laws, regulations, company rules and regulations, network security knowledge, and security product knowledge, popularize security knowledge, and enhance the safety awareness of all employees. Ordinary users of the network security auxiliary analysis and decision-making system based on the generative big model mainly involve functions such as querying laws and regulations, company rules and regulations, network security knowledge, and security product knowledge. First, the system has professional network security consulting business functions, which can provide ordinary users with inquiries and answers to basic network security knowledge and technical knowledge such as computer networks and cryptography. Users can obtain professional knowledge related to network security through the system and enhance their own network security awareness and skills. Secondly, the system also deeply integrates the company's relevant network security management system or technical specifications, so that ordinary users can easily and quickly check and understand the company's network security policies and processes, and improve the company's network security management efficiency and effectiveness. In addition, through the knowledge base function of the big model, the system provides users with a rich knowledge reserve, including laws, regulations, company rules and regulations, network security knowledge, etc., to meet the diversified knowledge needs of users and help users learn and study network security. In general, the network security auxiliary analysis and decision-making system based on the generative large model provides ordinary users with a one-stop network security consultation and learning platform, which not only improves the user's network security knowledge level, but also improves the company's network security management efficiency and effectiveness. Through the application of the system, ordinary users can more conveniently obtain and understand network security-related knowledge and information, thereby improving network security awareness and network security protection capabilities.

[0079] Specifically, the generative big model also includes a smart homepage function, which can customize the display of focus content based on the questions recently raised by users, and provide users with personalized network security information services. The smart homepage module is an important component of the network security auxiliary analysis and decision-making system based on the generative big model. Its core function is to provide users with personalized network security information services. This module can automatically record and analyze the network security issues recently raised by users, and intelligently infer the user's focus and information needs based on these issues. Then, it customizes these focus contents into intuitive pages for display, so that users can grasp the network security dynamics and information they care about at a glance. In this way, the smart homepage not only improves the efficiency of users in obtaining information, but also enhances the use value of the system, providing strong support for users' network security management work.

[0080] In summary, the entire question-and-answer consultation process of the power network security intelligent consulting system based on the generative big model will rely on the advanced deep learning models and algorithms in the generative big model to ensure that the system can automatically and accurately answer various network security questions raised by users and provide timely and professional consulting services. This technical route integrates a variety of advanced technologies such as deep learning, knowledge reasoning and association analysis, aiming to build an efficient and intelligent network security question-and-answer consultation system to meet the needs of users in the field of network security.

[0081] In summary, the present invention relies on the advanced deep learning models and algorithms in the generative large model throughout the entire question-and-answer consultation process of the system to ensure that the system can automatically and accurately answer various network security questions raised by users and provide timely and professional consulting services. This technical route integrates a variety of advanced technologies such as deep learning, knowledge reasoning, and association analysis, aiming to build an efficient and intelligent network security question-and-answer consultation system to meet the needs of users in the field of network security.

[0082] Example 2 is an embodiment of the present invention, which provides an intelligent consulting system for power network security based on a generative large model. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0083] This embodiment conducted a three-month system performance verification experiment in an electric power network environment with 100 nodes. Ten typical security scenarios were selected, including malicious code detection, abnormal traffic identification, and intrusion detection. During the experiment, a distributed deployment architecture was adopted. Each node was equipped with a dual-channel Intel Xeon processor and 128GB memory. By simulating real network attack scenarios, more than 1 million security event data were collected. The system of the present invention adopts a generative large model based on the Transformer architecture. The number of model parameters reaches 1 billion. It is pre-trained and fine-tuned on the specific corpus of the power industry. The knowledge base contains more than 500,000 professional knowledge items in the field of power safety.

[0084] The experiment adopted a hierarchical evaluation method, focusing on the performance of the system in key indicators such as security incident detection rate, analysis response time, and false alarm rate. Through comparative analysis, it was found that the system of the present invention, with the support of the deep learning model, can effectively identify complex attack patterns, especially when dealing with zero-day vulnerabilities and unknown threats. Through continuous learning and knowledge accumulation, the detection accuracy of the system has shown a steady improvement trend over time, reaching a high accuracy level of 98.5% in the later stage of the experiment. In addition, with the parallel computing power of the generative large model, the average response time of the system is reduced to less than 200ms, which is about 65% higher than the traditional solution, providing a strong guarantee for the timely detection and handling of security threats.

[0085] Table 1 Safety system performance comparison data table

[0086]

[0087] Through in-depth analysis of experimental data, it can be concluded that the present invention is significantly superior to existing technical solutions in multiple key performance indicators. From the perspective of time, the system performance shows a continuous optimization trend, the detection rate has increased from 95.8% in the early stage to 98.5%, and the false alarm rate has decreased from 1.8% to 0.9%, reflecting the self-learning ability of the system; from the perspective of efficiency, the average response time of the present invention is only 180ms, which is 69% higher than the 580ms of the traditional rule matching system, and the concurrent processing capacity reaches 5200 times / second, which is 4.3 times that of the traditional system; from the perspective of accuracy, the knowledge base coverage of the system reaches 95.8%, which is 20 percentage points higher than the traditional system, thanks to the powerful knowledge acquisition and reasoning ability of the generative large model; from the perspective of user experience, the system has obtained a high satisfaction rate of 9.6 points, which is 33.3% higher than the traditional system, which fully demonstrates the superiority of the present invention in practical applications. These data fully prove that the present invention has significant technical advantages and application value in the field of power network security protection.

[0088] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An intelligent consulting system for power network security based on a generative large model, characterized in that: include: A consultation and question-answering function module, which includes a technical consultation unit, an attack and defense analysis unit, and a protection and disposal suggestion unit; A generative big model, which is based on deep learning methods and large-scale corpus training to discover statistical relationships and patterns in text data. During the training process, the model will learn to generate new data samples to establish a network security knowledge base. The network security knowledge base provides data support for the technical consulting unit, the attack and defense analysis unit, and the protection and disposal recommendation unit. The consultation question and answer function module is based on the network security knowledge base in the generative big model to understand and answer the power network security issues raised by users.

2. The power network security intelligent consulting system based on the generative large model according to claim 1 is characterized by: The generative large model includes: A deep neural network architecture unit that captures the semantic relationship of input text through self-attention mechanism; Pre-training unit, used for pre-training on the corpus in the field of power network security; A fine-tuning unit, used to adjust the parameters of the pre-trained model for a specific security consulting task; The vector representation unit is used to convert professional vocabulary in the security field into representation in a high-dimensional vector space.

3. The power network security intelligent consulting system based on the generative large model as claimed in claim 2 is characterized by: The dialogue processing process of the generative large model includes: Get the historical conversation records of the current session; Extract key information and context from the conversation; Semantically understand the current input based on contextual information; If the context is detected to be relevant, the historical information is incorporated into the response generation process; otherwise, the response is generated based only on the current input.

4. The power network security intelligent consulting system based on the generative large model as claimed in claim 3 is characterized by: The response generation process of the generative large model includes: Identify professional terms in the security field for input questions; Select the corresponding knowledge base retrieval strategy based on the question type; Extract relevant information from the knowledge base; If the completeness of the extracted information exceeds the preset threshold, a response is generated directly; otherwise, a response is generated after supplementing the necessary information through knowledge reasoning.

5. The power network security intelligent consulting system based on the generative large model according to claim 4 is characterized by: The users covered by the consultation and question-answering function module include security decision-makers, security operations personnel and ordinary personnel. The processing of different user roles includes: If a person is identified as a security decision-maker, the security situation screen data is obtained and updated at preset time intervals. At the same time, a risk warning index is generated based on statistical analysis of historical security events. If identified as a security operator, they will receive real-time security logs and conduct event tracing analysis based on preset association rules; If the person is identified as an ordinary person, their historical access records will be obtained and personalized security knowledge content will be recommended based on the user portrait.

6. The power network security intelligent consulting system based on the generative large model according to claim 5 is characterized by: The data processing process of the security decision maker includes: If an abnormal risk warning is received, relevant security event information will be automatically aggregated and the emergency response process will be triggered; If the security situation score is detected to be lower than the first preset threshold, the security reinforcement strategy is initiated and a special protection recommendation report is generated; If the frequency of a certain type of security incident is found to exceed the second preset threshold, the protection strategy weight of this type of incident will be automatically adjusted and the detection rules will be optimized.

7. The power network security intelligent consulting system based on the generative large model according to claim 6 is characterized by: The event analysis process of the security operator includes: If a security event with unknown characteristics is detected, the similarity between its feature vector and the historical events in the knowledge base is calculated; If the similarity exceeds a third preset threshold, the event is classified into the most similar known event type and the feature library is updated; If the similarity is lower than the fourth preset threshold, a new event type is created, and the deep analysis process is triggered at the same time to expand the feature library through multi-dimensional feature extraction.

8. The power network security intelligent consulting system based on the generative large model according to claim 7 is characterized by: The knowledge push process of ordinary personnel includes: If the user queries a certain security knowledge point, the pre-knowledge dependency relationship of the knowledge point is analyzed; If necessary prerequisite knowledge exists, the learning content of the prerequisite knowledge will be pushed first; If the user's query frequency in a specific knowledge field exceeds the fifth preset threshold, a deep learning path for that field is automatically generated.

9. The power network security intelligent consulting system based on the generative large model according to claim 8 is characterized by: It also includes a smart homepage module, and the personalization process of the smart homepage module includes: If the security knowledge points that the user has recently visited are related, a knowledge graph will be automatically constructed and displayed according to the strength of the association between the knowledge points; If it is detected that the user's attention to a certain type of security incident exceeds the sixth preset threshold, the latest developments and protection suggestions for this type of incident will be pushed first; If the user's access pattern shows regularity in a specific time period, preload related content to improve response speed.

10. The power network security intelligent consulting system based on the generative large model according to claim 9, characterized in that: The collaborative processing process of the technical consulting unit, the attack and defense analysis unit and the protection disposal suggestion unit includes: If the technical consulting unit receives a security incident alert, the attack and defense analysis unit is called to perform risk level assessment; If the risk level assessed by the attack and defense analysis unit exceeds the first preset threshold, the protection disposal suggestion unit is triggered to generate an emergency disposal plan; If the emergency response plan involves multiple security domains, the response steps are prioritized and conflicts are detected based on the knowledge reasoning capability of the generative big model.

Images