Network security intelligent association analysis method based on generative large model

Abstract

The invention discloses a network security intelligent association analysis method based on a generative large model, and relates to the technical field of security risk intelligent analysis, and the method comprises the steps: designing a network security consultation analysis framework of a question and answer mode; network security intelligent association analysis is carried out by using a generative large model technology; collecting data based on a network security analysis system and performing intelligent summarization analysis by using a large model; constructing a power network security analysis large model base, fusing general knowledge, network security knowledge and power network security attack and defense confrontation data by the large model base, automatically identifying and associating dispersed network security data through network security intelligent association analysis, and mining potential threats; and completing optimization of the large model base by utilizing prompt optimization and LORA fine tuning technologies. Through an intelligent analysis, research and judgment technology based on a large model, a large amount of network data can be automatically processed and analyzed, potential security threats can be rapidly identified, the analysis, research and judgment efficiency and accuracy are improved, and the manual analysis burden is relieved.

Description

Technical Field

[0001] The present invention relates to the technical field of security risk intelligent analysis, and in particular to a network security intelligent correlation analysis method based on a generative large model. Background Art

[0002] At present, my country has built the world's largest, most technologically advanced, and most complex power system, but my country has long lagged behind Western countries in the field of network security, becoming the best country for network security. Western countries are far ahead of my country in terms of network security theory system, technical equipment, and network security level. my country has to adopt traditional conservative protection methods such as traditional network isolation and border protection in the field of key information infrastructure such as power energy.

[0003] In terms of IoT security risks, many IoT devices lack basic security measures and can be easily used by attackers as a gateway into the power grid system. Equipment manufacturers and power grid operators may fail to update and patch equipment vulnerabilities in a timely manner, leaving attackers with opportunities to exploit. Smart meters and sensors in the power grid collect a large amount of user data. If this data is not properly protected, it may be illegally obtained and abused. Attackers may tamper with data, causing the management system to make wrong decisions and affect the stability of the power grid. The rapid development of digital power grids not only brings network security risks to the Internet of Things, but also poses new security challenges to data centers.

[0004] As the core hub of the digital power grid, data centers are responsible for processing and storing a large amount of power data and control information, so their security is of vital importance. Distributed denial of service attacks can cause the network bandwidth of data centers to be exhausted, affecting the availability of data transmission and services. Attackers may invade data centers through malware, steal sensitive data, encrypt data for ransom, or even destroy system functions. Data centers store a large amount of power user data, operation data, and control information, which may be illegally obtained and used. Attackers may tamper with the data in the data center, causing the power system to make wrong decisions and affecting the stable operation of the power grid.

[0005] The power grid management business has gradually migrated to the power grid management platform, which stores a large amount of basic data on power grid operation. However, this data cannot be interconnected with the basic data of situational awareness, forming an information island, making it difficult to assist on-duty personnel in handling network security risks and providing support for the company's digital transformation. Therefore, it is urgent to use advanced technologies to solve the network security problems brought about by the rapid development of digital power grids.

[0006] With the rapid development of digital grid technology, the efficiency of energy management and power distribution has been significantly improved. However, this progress is also accompanied by an increase in a series of cybersecurity risks, posing a serious threat to Internet of Things (IoT) devices, data centers, China Southern Power Grid Cloud, and grid management platforms.

[0007] In response to the network security needs and business difficulties such as low intelligent monitoring level, low intelligent analysis level, and low security disposal and operation efficiency of power energy network security, we took the lead in the industry to carry out research on key technologies of network security intelligent correlation analysis based on generative large models;

[0008] The power grid company has built a network security operation analysis system that is horizontally coordinated and vertically integrated, but it still uses manual expert analysis and manual tracing to confront network security attacks and defenses. There are a series of problems such as large analysis workload, low handling efficiency, difficulty in dealing with complex threats, and difficulty in passing on manual experience. It is unable to cope with high-intensity attack and defense detection and operation needs. Summary of the invention

[0009] In view of the above-mentioned problems, the present invention is proposed.

[0010] Therefore, the present invention provides a network security intelligent association analysis method based on a generative large model, which can solve the problems mentioned in the background technology.

[0011] To solve the above technical problems, the present invention provides the following technical solutions: a network security intelligent association analysis method based on a generative large model, comprising: a network security consulting analysis framework designed in a question-answering mode;

[0012] Use generative big model technology to conduct intelligent correlation analysis of network security;

[0013] Collect data based on the network security analysis system and use large models for intelligent summary and analysis;

[0014] Constructing a large-scale model base for power network security analysis, wherein the large-scale model base integrates general knowledge, network security knowledge, and power network security attack and defense confrontation data, and automatically identifies and associates scattered network security data through the network security intelligent association analysis to mine potential threats;

[0015] The optimization of the large model base is completed using prompt optimization and LORA fine-tuning technology.

[0016] As a preferred solution of the network security intelligent correlation analysis method based on the generative large model described in the present invention, wherein: the network security intelligent correlation analysis includes network security summary analysis and power network security intelligent consultation;

[0017] The cybersecurity consulting and analysis framework integrates cybersecurity knowledge and experience to provide intelligent consulting services;

[0018] The collected data includes network security logs, traffic information and network security alarms, and uses large models to perform deep data mining and multi-dimensional correlation analysis.

[0019] As a preferred solution of the network security intelligent association analysis method based on the generative large model described in the present invention, wherein: the network security summary analysis uses the large model to perform intelligent summary analysis and provide auxiliary decision-making reports;

[0020] The power network security intelligent consultation adopts an analysis framework of question-answer mode.

[0021] As a preferred solution of the network security intelligent association analysis method based on the generative large model described in the present invention, the deep data mining and multi-dimensional association analysis include:

[0022] Build an intelligent summary and analysis model to summarize and judge the status of network security attack and defense confrontation;

[0023] Automatically generate a decision-making support analysis report based on the summary and analysis results;

[0024] The network security consulting and analysis framework includes the establishment of a network security knowledge base, intelligent question and answer, and automatic generation of security recommendations.

[0025] As a preferred solution of the network security intelligent association analysis method based on the generative large model described in the present invention, the service objects of the network security consulting and analysis framework include company leaders, network security management and operation personnel and ordinary users.

[0026] As a preferred solution of the network security intelligent association analysis method based on the generative large model described in the present invention, the network security intelligent association analysis includes:

[0027] Collect power system cybersecurity data and clean, classify and annotate it to build a training data set;

[0028] Using a general large model as a basis, it is adapted to the field of power network security through pre-training and fine-tuning;

[0029] Conduct intelligent correlation analysis on network security data based on trained large models to identify potential threats and attack patterns;

[0030] Provide attack and defense suggestions and security consultation based on the analysis results.

[0031] As a preferred solution of the network security intelligent association analysis method based on the generative large model described in the present invention, the intelligent association analysis uses association rule mining, clustering analysis and classification algorithms to perform association analysis on features.

[0032] To further solve the above technical problems, the present invention provides the following technical solutions: A network security intelligent association analysis system based on a generative large model, comprising: a consultation framework module, which is used to design a network security consultation analysis framework in a question-and-answer mode;

[0033] The correlation analysis module is used to conduct intelligent correlation analysis of network security using generative large model technology;

[0034] Summary and analysis module, used to collect data based on the network security analysis system and use large models for intelligent summary and analysis;

[0035] A base construction module is used to construct a large-scale model base for power network security analysis, wherein the large-scale model base integrates general knowledge, network security knowledge, and power network security attack and defense confrontation data, and automatically identifies and associates scattered network security data through the network security intelligent association analysis to mine potential threats;

[0036] The optimization and adjustment module is used to optimize the large model base using prompt optimization and LORA fine-tuning technology.

[0037] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of the network security intelligent association analysis method based on the generative large model as described above are implemented.

[0038] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the network security intelligent association analysis method based on a generative large model as described above are implemented.

[0039] Beneficial effects of the present invention: The present invention gradually accumulates manual experience into machine experience, and improves the level of network security analysis and judgment. First, improve the efficiency and accuracy of analysis and judgment: Traditional network security analysis and judgment rely on manual experience and professional knowledge, which often requires a lot of manpower and time. Intelligent analysis and judgment technology based on large models can automatically process and analyze large amounts of network data, quickly identify potential security threats, and generate accurate analysis and judgment results. This will greatly improve the efficiency and accuracy of analysis and judgment, making network security protection more timely and effective.

[0040] Second, it reduces the burden of manual analysis. In the field of network security, manual analysis and judgment is a heavy and complex task. As network threats continue to increase and become more complex, the burden of manual analysis and judgment is getting heavier. Intelligent analysis and judgment technology based on large models can undertake most of the analysis work, reduce the burden of manual analysis, and enable security experts to focus more on complex analysis and strategy formulation.

[0041] Finally, integrate and accumulate expert experience. Security experts have accumulated a lot of experience and knowledge in their long-term work, which is of great value to network security analysis and judgment. Intelligent analysis and judgment technology based on large models can integrate these expert experiences into the model, so that the machine can learn and master the expert's analysis methods and ideas. At the same time, with the continuous learning and application of the machine, these experiences will be further accumulated and optimized, forming a richer machine experience library. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0043] Figure 1 This is a schematic diagram of the overall process of a network security intelligent association analysis method based on a generative large model proposed by the present invention;

[0044] Figure 2 This is a computer equipment diagram in a network security intelligent association analysis method based on a generative large model proposed by the present invention. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0046] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0047] Example 1, reference Figure 1, as an embodiment of the present invention, provides a network security intelligent association analysis method based on a generative large model.

[0048] Key technologies of intelligent consultation on power network security, through the design of a network security consultation analysis framework in question-and-answer mode;

[0049] Network security intelligent correlation analysis, in order to solve the problems of low efficiency and low intelligence level of digital power grid network security correlation analysis, the generative large model technology is used to carry out research on network security intelligent correlation analysis technology; the purpose is to improve the efficiency of network security detection and analysis by designing a question-and-answer-based network security intelligent analysis model, so as to cope with increasingly complex network security threats;

[0050] The key technology of network security summary and analysis will be based on the data collected by the company's existing network security analysis system, use big models to conduct intelligent summary and analysis, and provide auxiliary decision-making reports, thereby improving the accuracy and efficiency of network security disposal;

[0051] Construct a large-scale model base for power network security analysis, which integrates general knowledge, network security knowledge, and power network security attack and defense confrontation data, and automatically identifies and associates scattered network security data through the network security intelligent correlation analysis technology to mine potential threats;

[0052] Relying on the large model base described in the power network security analysis, through prompt optimization and LORA fine-tuning technology. Network security analysis and intelligent correlation analysis technology research, improve the accuracy and efficiency of network security analysis; security event correlation analysis, question-and-answer analysis mode, improve the efficiency of network security correlation analysis.

[0053] Prompt optimization and LORA fine-tuning technology can generate more accurate and natural answers. Prompt optimization can adjust the model's input to make it more consistent with the model's understanding, thereby improving the model's accuracy. LORA fine-tuning technology can further optimize the model's parameters to better adapt it to specific tasks and fields.

[0054] In addition, by using these technologies, the generalization ability of the model can be improved, enabling it to handle more situations and tasks. This is very important for some application scenarios that need to process multiple different types of data. Prompt optimization and LORA fine-tuning technology are effective means to improve the performance of large model bases. By continuously optimizing and improving these technologies, large model bases can be made more intelligent, efficient and accurate, providing better services and support for various application scenarios.

[0055] This research point mainly focuses on the problems of low efficiency and low intelligence level of digital power grid network security correlation analysis, and uses generative large model technology to carry out research on network security intelligent correlation analysis technology. It aims to improve the efficiency of network security detection and analysis by designing a question-and-answer-based network security intelligent analysis model to cope with increasingly complex network security threats.

[0056] The main purpose is to design a question-and-answer based network security intelligent analysis model to improve the efficiency of network security detection and analysis through multi-dimensional data correlation analysis.

[0057] The technical architecture of the generative large model mainly includes the neural network structure and training methods. In terms of neural network structure, the Transformer model is a neural network model based on the self-attention mechanism, which has the advantages of parallel computing capabilities and long-distance dependency modeling. Generative large models usually adopt the Transformer architecture to learn the feature representation of data through multiple layers of self-attention mechanisms and feedforward neural network layers. In terms of training methods, generative large models usually adopt pre-training and fine-tuning methods. In the pre-training stage, the model is trained on large-scale unlabeled data to learn the general feature representation of the data. In the fine-tuning stage, the model is trained on labeled data for specific tasks, and the parameters of the model are adjusted to meet the needs of specific tasks. In addition, the generative large model also uses some optimization techniques, such as stochastic gradient descent, learning rate adjustment, regularization, etc., to improve the training efficiency and performance of the model.

[0058] In a specific implementation of the present invention, the research content of network security intelligent correlation analysis includes: research on key technologies of network security summary analysis, and research on key technologies of power network security intelligent consultation.

[0059] In terms of implementation, first, we will conduct in-depth research on the application of generative big models in the field of network security and build a big model suitable for the characteristics of digital power grids; second, by combining with the actual network security analysis system, we will train and tune the model to ensure its effectiveness in practical applications: finally, we will design and implement a network security intelligent correlation analysis system based on this technology, and carry out actual deployment and testing to verify its performance and effectiveness in actual operations.

[0060] In a specific implementation of the present invention, based on the massive data collected by the company's existing network security analysis system, including network security logs, traffic information, and network security alarms, a large model is used to perform in-depth data mining and multi-dimensional correlation analysis.

[0061] During the implementation process, the latest large model technology will be combined to continuously optimize the processing and analysis process of network security data to ensure that the network security status of the power grid can be accurately and quickly grasped. At the same time, we will work closely with relevant departments of the company to jointly promote the research and development and application of this technology to ensure the network security, stability and efficient operation of the digital power grid. Through the in-depth exploration and practice of this research point, it is expected to contribute important forces to the improvement of the network security level of the digital power grid. This research point is mainly aimed at the current situation of low efficiency and low intelligence level of digital power grid network security correlation analysis. It strives to use large model technology to achieve intelligent summary and analysis of the network security attack and defense confrontation status, thereby improving the network security detection and analysis efficiency of the power grid.

[0062] In a specific implementation of the present invention, a network security consulting system framework based on a generative large model is constructed, which can integrate various network security knowledge and experience to provide intelligent consulting services.

[0063] During the implementation process, we will first collect and organize relevant knowledge in the field of power network security to build a complete network security knowledge base. Then, we will use the powerful natural language processing capabilities of the generative large model to train the intelligent question-answering system so that it can accurately understand the security questions raised by users and obtain relevant information from the knowledge base, and finally generate targeted security suggestions or solutions. In this way, we can not only greatly improve the efficiency of network security consulting services, but also ensure their accuracy and practicality, and provide strong support for the network security protection work of the power industry. This study aims to improve the efficiency and accuracy of power network security consulting services through intelligent technology to cope with increasingly complex network security threats.

[0064] In a specific implementation of the present invention, the research on key technologies for network security summary and analysis will use large models to perform intelligent summary and analysis based on data collected by existing network security analysis systems, and provide auxiliary decision-making reports, thereby improving the accuracy and efficiency of network security disposal; the research on key technologies for intelligent consulting on power network security provides comprehensive network security services by designing a network security consulting and analysis framework with a question-and-answer mode, including basic technical consulting, attack and defense analysis, and protection and disposal recommendations.

[0065] In a specific implementation of the present invention, by constructing an intelligent summary and analysis model, a comprehensive summary and analysis of the daily network security attack and defense confrontation status is carried out; thereby, potential security risks and threats are discovered in a timely manner; finally, based on the summary and analysis results, an auxiliary decision-making analysis report is automatically generated to provide accurate and efficient decision-making support for network security managers.

[0066] In a specific implementation of the present invention, key technologies of network security consulting are studied in view of the characteristics and security requirements of the power network, including the establishment of a network security knowledge base, intelligent question-and-answer technology, and automatic generation of security recommendations; these technologies will jointly support the efficient operation of the consulting system and achieve rapid response and accurate answers to various security issues.

[0067] In a specific embodiment of the present invention, the research on intelligent consulting on power network security is aimed at all users, including company leaders, network security management and operation personnel and ordinary users, to provide intelligent consulting services on network security, such as determining whether suspicious emails are phishing emails, analyzing security trends, and answering network security knowledge questions.

[0068] In a specific embodiment of the present invention, the intelligent correlation analysis of massive network security data is realized by using the generative large model technology, including the following steps:

[0069] S1. Data collection and preprocessing: Efficiently collect power system network security data, clean, classify and label it, and build a high-quality training data set;

[0070] S2. Model training and optimization: Using a general large model as a basis, through pre-training and fine-tuning strategies, it is adapted to the characteristics of the power network security field;

[0071] S3, Intelligent correlation analysis: Based on the trained large model, intelligent correlation analysis is performed on massive network security data to identify potential threats and attack patterns;

[0072] S4. Decision support: Based on the analysis results, provide intelligent decision support to network security personnel, including attack and defense suggestions and security consultation.

[0073] In a specific implementation of the present invention, intelligent association analysis uses association rule mining, cluster analysis, and classification algorithm techniques to perform association analysis on the extracted features.

[0074] We will conduct in-depth research on the application of generative big models in the field of network security and build a big model suitable for the characteristics of digital power grids. Secondly, by combining it with the actual network security analysis system, we will train and tune the model to ensure its effectiveness in practical applications. Finally, we will design and implement a network security intelligent correlation analysis system based on this technology, and conduct actual deployment and testing to verify its performance and effectiveness in actual operations.

[0075] Embodiment 2 is an embodiment of the present invention, which provides a network security intelligent association analysis system based on a generative large model, including:

[0076] Consulting framework module, which is used to design a cybersecurity consulting analysis framework in question-and-answer mode;

[0077] The correlation analysis module is used to conduct intelligent correlation analysis of network security using generative large model technology;

[0078] Summary and analysis module, used to collect data based on the network security analysis system and use large models for intelligent summary and analysis;

[0079] A base construction module is used to construct a large-scale model base for power network security analysis, wherein the large-scale model base integrates general knowledge, network security knowledge, and power network security attack and defense confrontation data, and automatically identifies and associates scattered network security data through the network security intelligent association analysis to mine potential threats;

[0080] The optimization and adjustment module is used to optimize the large model base using prompt optimization and LORA fine-tuning technology.

[0081] Example 3, reference Figure 2 , is an embodiment of the present invention, which is different from the previous embodiment in that: if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0082] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0083] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0084] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0085] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security intelligent association analysis method based on a generative large model, characterized in that: include: Design a cybersecurity consulting analysis framework with a question-and-answer model; Use generative big model technology to conduct intelligent correlation analysis of network security; Collect data based on the network security analysis system and use large models for intelligent summary and analysis; Constructing a large-scale model base for power network security analysis, wherein the large-scale model base integrates general knowledge, network security knowledge, and power network security attack and defense confrontation data, and automatically identifies and associates scattered network security data through the network security intelligent association analysis to mine potential threats; The optimization of the large model base is completed using prompt optimization and LORA fine-tuning technology.

2. The network security intelligent association analysis method based on the generative large model according to claim 1 is characterized by: The network security intelligent correlation analysis includes network security summary analysis and power network security intelligent consultation; The cybersecurity consulting and analysis framework integrates cybersecurity knowledge and experience to provide intelligent consulting services; The collected data includes network security logs, traffic information and network security alarms, and uses large models to perform deep data mining and multi-dimensional correlation analysis.

3. The network security intelligent association analysis method based on the generative large model as claimed in claim 2 is characterized by: The network security summary analysis uses a large model to perform intelligent summary analysis and provide auxiliary decision-making reports; The power network security intelligent consultation adopts an analysis framework of question-answer mode.

4. The network security intelligent association analysis method based on the generative large model as claimed in claim 3 is characterized by: The deep data mining and multi-dimensional association analysis include: Build an intelligent summary and analysis model to summarize and judge the status of network security attack and defense confrontation; Automatically generate a decision-making support analysis report based on the summary and analysis results; The network security consulting and analysis framework includes the establishment of a network security knowledge base, intelligent question and answer, and automatic generation of security recommendations.

5. The network security intelligent association analysis method based on the generative large model according to claim 4 is characterized by: The service objects of the network security consulting and analysis framework include company leaders, network security management and operation personnel and ordinary users.

6. The network security intelligent association analysis method based on the generative large model according to claim 5 is characterized by: The network security intelligent correlation analysis includes: Collect power system cybersecurity data and clean, classify and annotate it to build a training data set; Using a general large model as a basis, it is adapted to the field of power network security through pre-training and fine-tuning; Conduct intelligent correlation analysis on network security data based on trained large models to identify potential threats and attack patterns; Provide attack and defense suggestions and security consultation based on the analysis results.

7. The network security intelligent association analysis method based on the generative large model according to claim 6 is characterized by: The intelligent association analysis uses association rule mining, cluster analysis and classification algorithms to perform association analysis on features.

8. A network security intelligent association analysis system based on a generative large model, based on the network security intelligent association analysis method based on a generative large model according to any one of claims 1 to 7, characterized in that: include, Consulting framework module, which is used to design a cybersecurity consulting analysis framework in question-and-answer mode; The correlation analysis module is used to conduct intelligent correlation analysis of network security using generative large model technology; Summary and analysis module, used to collect data based on the network security analysis system and use large models for intelligent summary and analysis; A base construction module is used to construct a large-scale model base for power network security analysis, wherein the large-scale model base integrates general knowledge, network security knowledge, and power network security attack and defense confrontation data, and automatically identifies and associates scattered network security data through the network security intelligent association analysis to mine potential threats; The optimization and adjustment module is used to optimize the large model base using prompt optimization and LORA fine-tuning technology.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security intelligent association analysis method based on a generative large model as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security intelligent association analysis method based on a generative large model described in any one of claims 1 to 7 are implemented.

Images