Network security report auxiliary generation method based on generative large model

Abstract

The invention discloses a network security report auxiliary generation method based on a generative large model, and relates to the technical field of power network security, and the method comprises the steps: collecting network security data; the method comprises the following steps: cleaning network security data, classifying and labeling the cleaned data, and constructing a training data set; the general large model is used as a basic model, and the basic model is trained through pre-training and fine tuning strategies; wherein a mixed precision training technology is adopted in the training process; and based on the trained model, according to a preset report template, in combination with an analysis result of the network security data, automatically filling the content of the report template, and generating a network security report. According to the invention, the automatic generation of the network security report is realized, the report generation time is greatly shortened, the time required by a traditional manual mode is shortened to a minute level from a relatively long time, and the working efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of power network security, and in particular to a network security report auxiliary generation method based on a generative large model. Background Art

[0002] In today's digital age, network security issues are becoming increasingly severe. Enterprises and organizations need to understand the network security status in a timely and accurate manner in order to take effective protective measures. As an important information carrier, network security reports can comprehensively summarize network security trends, analyze security incidents, and provide a basis for decision-making.

[0003] However, the traditional way of generating cybersecurity reports mainly relies on manual analysis and writing, which has problems such as low efficiency, low accuracy, and low intelligence. With the development of artificial intelligence technology, generative large models have made significant progress in fields such as natural language processing, providing new ideas and methods for the auxiliary generation of cybersecurity reports. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the present invention provides a network security report auxiliary generation method based on a generative large model, which can solve the problems mentioned in the background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security report auxiliary generation method based on a generative large model, comprising: collecting network security data;

[0007] Cleaning the network security data, classifying and labeling the cleaned data, and constructing a training data set;

[0008] A general large model is used as a basic model, and the basic model is trained through pre-training and fine-tuning strategies; wherein a mixed precision training technique is used in the training process;

[0009] Based on the trained model, according to the preset report template and combined with the analysis results of the network security data, the content of the report template is automatically filled in to generate a network security report.

[0010] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, wherein: the network security data includes network device logs, security device logs and traffic class logs;

[0011] Cleaning the network security data refers to using data cleaning technology to remove erroneous data, invalid data, redundant data, duplicate data and low-quality data;

[0012] Among them, the data cleaning technology includes rule-based data cleaning technology, which supports multiple rule types and logical operations between rules, has three data repair behaviors of retention, discarding and backfilling, and supports adding, deleting or modifying rules at runtime.

[0013] As a preferred solution of the network security report auxiliary generation method based on the generative big model described in the present invention, the data cleaning technology includes a collaborative filtering algorithm, through which a statistical model is established to describe the data distribution, score the data points, and filter out the data points with lower quality.

[0014] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, the data cleaning technology includes a document deduplication technology, and the document deduplication technology adopts at least one of the MD5 technology, SimHash technology and SubString technology to identify and remove duplicate documents by calculating the hash value or feature of the document.

[0015] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, the fine-tuning strategy includes the LoRA method, through which a low-rank matrix is ​​introduced to approximate the adaptive changes of the basic model, thereby reducing the number of parameters to be updated during the fine-tuning process.

[0016] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, wherein: the fine-tuning strategy includes an adapter adjustment method, through which an adapter is inserted into each layer or a specified layer of the basic model, and the basic model is adapted to the new task or field by training the parameters of the adapter;

[0017] The fine-tuning strategy includes a prefix adjustment method, by which a trainable, task-specific prefix is ​​added before the input sequence of the base model to achieve fine-tuning for different tasks;

[0018] The fine-tuning strategy includes a prompt adjustment method, by which a learnable embedding vector is introduced into the input of the base model as a prompt, and the base model is adapted to downstream tasks by adjusting the prompt.

[0019] As a preferred solution of the network security report auxiliary generation method based on the generative big model described in the present invention, the network security report includes attack type, attack source, attack target, attack time, security event overview, attacker overview, security operation report, and security recommendations.

[0020] To further solve the above technical problems, the present invention provides the following technical solutions: a network security report auxiliary generation system based on a generative big model, comprising: a data acquisition and preprocessing module: used to collect network security data, use data cleaning technology to clean, classify and label the collected data, and build a high-quality training data set; a model training and optimization module: used to use a general big model as a basis, through pre-training and fine-tuning strategies, to adapt it to the characteristics of the network security field; a report generation module: used to automatically fill in the template content based on the trained big model, according to the preset report template, combined with the analysis results of the network security data, to generate a network security report.

[0021] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of the network security report auxiliary generation method based on the generative large model as described above are implemented.

[0022] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the method for assisting in generating a network security report based on a generative large model as described above are implemented.

[0023] The beneficial effects of the present invention are as follows: 1. It realizes the automatic generation of network security reports, greatly shortening the report generation time from the long time required by the traditional manual method to minutes, thereby improving work efficiency; 2. It improves accuracy, based on the in-depth analysis and understanding of massive network security data by the generative big model, the generated report content is more accurate and reliable, and human errors are reduced; 3. It has a high degree of intelligence and can automatically identify and analyze network security incidents, provide intelligent security recommendations, and provide more powerful support for network security operations; 4. It has strong adaptability and can adapt to different network security scenarios and needs by fine-tuning strategies, and has good versatility and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0025] Figure 1 It is a data collection and preprocessing schematic diagram of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0026] Figure 2 It is a data cleaning schematic diagram of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0027] Figure 3 It is a document deduplication technology operation process of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0028] Figure 4 It is a schematic diagram of model training and optimization of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0029] Figure 5 It is a schematic diagram of the application deployment of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0031] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0032] Example 1, reference Figure 1 to Figure 5 , as an embodiment of the present invention, provides a network security report auxiliary generation method based on a generative large model.

[0033] 1. Data collection and preprocessing stage

[0034] 1) Data collection

[0035] 1- Internet data collection.

[0036] We carefully build customized web crawlers for key data sources such as authoritative websites in the field of network security, well-known security forums, and professional technical blogs. When writing crawlers, we fully consider the structure and data distribution characteristics of the website, and use advanced web page parsing technologies, such as combining BeautifulSoup and lxml libraries, to accurately locate and extract various useful information from web pages.

[0037] For structured data, such as tabular data in security vulnerability databases, crawlers are used to accurately identify and convert them into a format that is easy to process later, such as CSV files, to ensure the integrity and accuracy of the data. For unstructured data, such as detailed attack analysis articles posted by security experts on forums, in-depth defense strategy explanations in technical blogs, etc., through a meticulous text cleaning process, HTML tags, useless advertising information, confusing characters, and irrelevant redundant content are removed, and converted into a pure text format for in-depth analysis and processing.

[0038] At the same time, the crawling frequency and depth of the web crawler should be set reasonably to avoid excessive access pressure on the target website, while ensuring that comprehensive and up-to-date network security information can be obtained. For example, for frequently updated security news websites, a higher crawling frequency should be set to obtain real-time security dynamics; for in-depth technical analysis blogs, the crawling depth should be appropriately increased to dig out more valuable professional knowledge.

[0039] 2- Commercial security data procurement and integration

[0040] Establish long-term, stable and in-depth cooperation with data providers with excellent reputation and rich experience in the field of cybersecurity data. In the early stage of cooperation, conduct in-depth communication and demand research with data providers, and jointly develop a detailed and accurate data procurement plan based on the specific needs, application scenarios and expected goals of this project in assisting the generation of cybersecurity reports.

[0041] Clarify the specific types of commercial security data required, such as high-precision real-time threat intelligence data, which must cover the behavioral characteristics of various emerging malware worldwide, the complex tactics and procedures (TTPs) of attack organizations, detailed exploitation information of zero-day vulnerabilities, and potential threats to critical network assets; comprehensive and in-depth security incident case data to ensure that each case contains a complete incident background, a detailed description of the attack process at each step (including precise tracking of the attack path, detailed technical analysis of the exploited vulnerabilities, the spread of malware and the scope of infection, etc.), accurate and reliable impact assessment (involving precise definition of the scope of affected systems, precise statistics on the duration of business interruption, detailed quantification of the scale of data leakage, etc.), as well as effective response measures that have been proven effective in practice and a summary of lessons learned that are of profound reference value.

[0042] During the data access process, a strict and multi-dimensional data quality review mechanism is established. First, the consistency and accuracy of the data are checked by comprehensive comparison with the existing high-quality and reliable data samples. Secondly, professional data analysis algorithms are used to deeply check the integrity and logic of the data to ensure that the data meets the expected requirements in all dimensions. In addition, senior internal network security experts are invited to manually review the data. With their rich professional experience and keen insight, they evaluate and judge the authenticity, reliability and relevance of the data to the actual business scenarios. Through this comprehensive data quality review mechanism, it is ensured that the purchased commercial security data is accurate, unbiased and highly practical, which can provide a solid data foundation for subsequent analysis and decision-making.

[0043] 3- Data collection within the power system

[0044] Professional and efficient data collection agents are carefully deployed on the core network nodes and key safety equipment of the power system. These agents have powerful real-time monitoring and data collection capabilities, and can comprehensively collect massive log data, accurate alarm information and detailed flow data generated by various network devices (such as routers, switches, firewalls, intrusion detection / prevention systems, power monitoring systems, etc.).

[0045] For network equipment logs, not only do they record basic events such as subtle changes in the status of device interfaces, real-time updates of routing tables, and the establishment and disconnection of network connections, but they also collect detailed configuration information and comprehensive operating parameters of the equipment, such as the routing protocol configuration of routers, VLAN settings of switches, and access control policies of firewalls, so as to gain an in-depth understanding of the operating status of network equipment from multiple perspectives. Security equipment logs focus on the various security events they detect, including detailed characteristics of intrusion attempts, early signs of malware infection, and accurate identification of abnormal traffic patterns. At the same time, they accurately record key attributes such as the exact time of the event, source IP address, destination IP address, accurate identification of attack types, and detailed assessment of threat levels. Traffic data collection covers all aspects of network traffic, including source address, destination address, port number, protocol type, packet size, transmission time, and traffic flow direction. Through in-depth analysis of traffic data, serious security threats such as potential network scanning behaviors, data leakage risks, and signs of denial of service attacks can be discovered in a timely manner.

[0046] In order to ensure the integrity and confidentiality of the collected data during transmission, advanced data encryption technologies, such as AES encryption algorithm, are used to encrypt the collected data to prevent the data from being stolen or tampered with during transmission. At the same time, a strict data verification mechanism is established at the data receiving end, and the received data is checked for integrity using hash algorithms (such as SHA-256) to ensure that the data is not lost or damaged during transmission. In addition, the collected internal data of the power system is deeply integrated with other relevant data sources, such as the real-time operation data of the power production control system (including the operating status of the power generation equipment, the real-time parameters of power transmission, etc.), the user authentication and access records of the power marketing system (such as user login information, operation authority change records, etc.), and the command execution of the power dispatching system (such as the issuance of dispatching commands and feedback on execution results, etc.). Through advanced data fusion technology, a comprehensive, three-dimensional and dynamic power network security data view is constructed to provide a richer, more accurate and relevant data foundation for subsequent in-depth analysis and precise decision-making.

[0047] 2) Data cleaning:

[0048] 1-Implementation of rule-based data cleaning technology

[0049] Develop a detailed and highly targeted cleaning rule system for different types of network security data. For network device logs, strictly check whether the IP address strictly complies with the legal IP address format specification, whether the timestamp is accurate within a reasonable time range and the format uniformly follows international standards (such as ISO8601 standard format), whether the log message contains key information completely and is not mixed with garbled or unrecognizable characters, and at the same time ensure that the grammatical structure of the log message is correct and the semantics are clear. For security device logs, carefully verify whether the alarm level is accurate and consistent with the actual threat level, whether the attack type identification is accurate and strictly complies with the industry-recognized standard classification system, whether the event description is clear and does not contain vague or ambiguous expressions, and can accurately convey the key information of the event. For traffic data, comprehensively check whether the packet size is within a reasonable value range, whether the port number is a legal port number range, and whether the protocol type is a known and valid network protocol. At the same time, accurately identify and mark abnormal values ​​in the traffic data (such as overly large or undersized packets, abnormal port number usage, etc.).

[0050] When erroneous values ​​or inconsistencies are found in the data, they are scientifically processed according to the pre-set repair strategy. For erroneous data whose correct values ​​can be determined by referring to relevant context information, network topology, device configuration files or historical data, such as obvious spelling errors or erroneous IP addresses, inconsistent timestamp formats, etc., they are automatically corrected. For erroneous data whose correct values ​​cannot be determined, the appropriate processing method is selected according to the importance of the data, the impact on subsequent analysis, and the actual needs of the business. For example, for errors in critical business data, they are significantly marked as abnormal and the manual review process is immediately triggered, and experienced professionals conduct in-depth investigation and repair; for errors in non-critical data, if the number of erroneous data is small and has little impact on the overall analysis, you can choose to delete it directly or simply mark it so that it can be properly processed in subsequent analysis; if the number of erroneous data is large and may affect the accuracy of the analysis results, further analyze the distribution law and characteristics of the erroneous data, and try to make approximate repairs through statistical methods such as data interpolation and mean substitution, but at the same time record the repair process and basis for subsequent tracing and evaluation.

[0051] A flexible rule management mechanism is built to support users to dynamically add, delete or modify cleaning rules according to actual conditions during operation. When the power system network architecture changes (such as adding new network devices, adjusting network topology, etc.), security equipment is upgraded or updated (causing changes in log format or alarm rules), and business needs change (such as paying attention to new safety indicators or data features), users can easily and quickly adjust the cleaning rules through a friendly user interface or configuration file to ensure that the data cleaning process is always highly consistent with the actual business environment and needs, thereby continuously providing high-quality data cleaning services.

[0052] 2-Application of collaborative filtering algorithm

[0053] Collect a large number of carefully labeled high-quality network security data samples, which cover normal and abnormal network security data types, and each sample is accompanied by accurate and detailed quality labels, such as "high quality (noise-free, complete and accurate)", "low quality (containing a small amount of noise, some information is missing or there are minor errors)", "suspected anomaly (data features obviously deviate from the normal mode but the specific problem cannot be determined)", etc. Based on these rich and diverse data samples, train a highly accurate quality assessment model. During the training process, the model deeply learns the intrinsic relationship between various complex features in the data (such as the fluctuation pattern of network traffic, the size distribution of data packets, the frequency and type combination of security device alarms, etc.) and quality labels. For example, for network traffic data, the model learns the characteristics of normal traffic such as traffic size, traffic change rate, protocol distribution in different time periods and different business scenarios, as well as the unique characteristic patterns of abnormal traffic (such as DDoS attack traffic, malware communication traffic, etc.), thereby establishing a mapping relationship between traffic data characteristics and quality labels; for security equipment alarm data, the model learns the frequency distribution of alarms, the combination pattern of alarm types, and the correlation with other related events (such as network traffic anomalies, error records in system logs, etc.) and other characteristics that affect quality, thereby building an effective model between alarm data characteristics and quality assessment.

[0054] The trained quality assessment model is applied to the large-scale data sets actually collected. The model performs a comprehensive and detailed quality score on each piece of data, and conducts a comprehensive evaluation based on multiple dimensions such as the similarity between the data and the learned high-quality data patterns and the degree of matching with abnormal data features. For example, for a piece of network traffic data, the model will analyze the similarity between its traffic size, change trend, protocol usage and other characteristics and normal traffic patterns, as well as whether there are features similar to known attack traffic patterns, so as to give an accurate quality score. According to the set reasonable quality threshold, low-quality data points with scores below the threshold are accurately filtered out. At the same time, in order to adapt to the dynamic changes in the network security environment (such as the emergence of new attack methods, changes in data patterns caused by business system upgrades, etc.), the quality assessment model is regularly updated and optimized using the latest labeled data to ensure that the model can continuously and accurately assess data quality and always provide a reliable data foundation for subsequent analysis.

[0055] 3-Document deduplication technology operation process

[0056] When using MD5 technology to deduplicate documents, the MD5 hash value of each document is efficiently calculated, and these hash values ​​are stored in an optimized data structure, such as a hash table, to achieve fast search and comparison. When processing a new document, its MD5 hash value is quickly calculated and efficiently searched in the hash table. If the hash values ​​are the same, it is highly suspected that the document is duplicated, and further detailed content comparison (such as comparing the key parts, summaries or feature vectors of the document, etc.) is performed to confirm whether it is truly duplicated; if different, the document is retained. In order to improve computing efficiency, especially for large documents, a strategy of calculating MD5 hash values ​​in blocks is adopted. The document is divided into multiple smaller blocks, and the MD5 hash value of each block is calculated separately. Then, the hash values ​​of these blocks are combined through a specific algorithm to obtain the final MD5 hash value of the document. This can significantly reduce computing time and memory usage while maintaining a high deduplication accuracy.

[0057] When using SimHash technology, a representative low-dimensional vector representation is generated for each document, and each bit of the vector is based on the semantic features of a specific word or phrase in the document. The similarity between vectors is calculated to accurately determine whether the documents are similar or duplicated. When calculating the similarity, an efficient vector similarity calculation algorithm, such as the cosine similarity algorithm, is used to quickly and accurately evaluate the similarity between documents. A reasonable similarity threshold is set. When the SimHash vector similarity of two documents exceeds the threshold, they are considered to be similar or duplicate documents and require further review or processing; if the similarity is lower than the threshold, the document is retained. At the same time, in order to improve the performance and adaptability of SimHash technology, the parameters and strategies of vector generation are flexibly adjusted according to the type, length and application scenario of the document, such as selecting different words or phrases as the basis of the vector, adjusting the dimension of the vector, etc., to optimize the deduplication effect.

[0058] When using SubString technology, the document is cleverly divided into multiple meaningful substrings, and these substrings are stored in a carefully designed index structure for fast retrieval. When checking whether a new document is duplicated, all its substrings are efficiently extracted and quickly searched in the index. If there are a large number of identical substrings and the number exceeds a certain reasonable proportion, the document is determined to be likely to be duplicated, and further detailed comparisons are performed or corresponding processing is performed according to specific business rules. At the same time, the length and selection strategy of the substring are dynamically adjusted according to the length of the document, the importance of the content, and the needs of the application scenario. For example, for longer documents, the length of the substring can be appropriately increased to improve the accuracy of deduplication, but it may increase the computing and storage costs; for scenarios with high real-time requirements, the length of the substring can be appropriately shortened to speed up processing, but it may slightly reduce the accuracy of deduplication. Through this flexible adjustment strategy, the best balance between the accuracy and efficiency of deduplication is achieved to meet the needs of different business scenarios.

[0059] 3) Data classification and labeling:

[0060] 1-Implementation of large model intelligent classification method based on Prompt project

[0061] From the vast amount of samples to be labeled, a small number of highly representative and diverse labeled samples are carefully selected as valuable reference sets. These labeled samples cover various types of network security data, such as different types of attack data (including DDoS attacks, SQL injection attacks, malware infection data, etc.), normal network traffic data, normal operation data of security devices, network configuration information data, etc., to ensure that the reference set can fully reflect the data characteristics and patterns in the field of network security.

[0062] For each type of data, we conduct in-depth research on its unique characteristics and patterns, and develop detailed and accurate classification rules and annotation standards. For example, for DDoS attack data, the characteristics may include connection requests from a large number of different source IP addresses in a short period of time, the concentration of target IP addresses and abnormally large traffic, and the data packet content has specific attack characteristics (such as specific malicious instructions or request formats); for SQL injection attack data, the characteristics are malicious SQL statement fragments in user input or network requests, such as special character combinations (such as 'or1=1--), frequent attempts to transform SQL query statements, etc.; for normal network traffic data, its characteristics are usually in compliance with network protocol specifications, stable traffic patterns within a reasonable range, and the use of source and destination IP addresses and ports in accordance with normal business logic, etc.; for normal operation data of security equipment, it includes normal equipment startup and shutdown records, regular health check information, normal configuration update records, etc.; for network configuration information data, it has specific formats and grammatical rules, such as routing table items in router configuration and access control rules in firewall configuration.

[0063] The selected reference samples are input into the 100 billion-level large model, and the large model's powerful semantic understanding and pattern recognition capabilities are used to conduct in-depth analysis of the reference samples to extract the key features and semantic representations of various types of data. For example, by learning from a large number of DDoS attack samples, the large model can automatically identify the traffic characteristics, data packet structure characteristics, and time series characteristics related to the attack, and convert these characteristics into semantic representations that the model can understand, forming a feature vector space for DDoS attacks. Similarly, for other types of data, such as SQL injection attacks, normal traffic, etc., corresponding feature vector spaces are also constructed to establish a semantic-based classification model.

[0064] For the massive sample data to be classified, it is input into the trained large model based on the Prompt project. The model calculates the similarity between the sample to be classified and the feature vectors of each category based on the learned feature vector space of each type of data. For example, by calculating the cosine similarity or other appropriate similarity measurement indicators, the closeness of the sample to be classified to the DDoS attack feature vector space, SQL injection attack feature vector space, normal traffic feature vector space, etc. is judged. According to the size of the similarity, the sample to be classified is assigned to the most similar category to achieve automatic classification.

[0065] During the classification process, the model continuously learns and optimizes the classification rules. When encountering inaccurate or uncertain samples, the model interacts through a feedback mechanism with manual annotations. For example, samples with low credibility in the classification results (such as similarity close to the classification threshold) are submitted to manual experts for review and annotation. Experts correct the classification errors of the model based on their professional knowledge and experience, and feed back the correct annotations to the model. Based on these feedbacks, the model further adjusts the classification rules and feature vector space to improve the accuracy and reliability of classification. At the same time, as new network security data continues to be generated and network attack methods continue to evolve, the reference sample set is regularly updated, and new attack types or data patterns are incorporated into the training data, so that the model can adapt to changes in the network security environment in a timely manner and maintain the effectiveness of classification.

[0066] 2. Model training and optimization stage

[0067] 1) Model selection and basic settings

[0068] After performance evaluation and adaptability analysis of a variety of general large models, GPT-4 was selected as the basic model (this is only an example, and other suitable models can be selected according to actual needs). GPT-4 performs well in natural language understanding and generation capabilities, and can better handle complex text data in the field of network security. Before use, the model is initialized as necessary, including adjusting the model's hyperparameters, such as setting the initial value of the learning rate to 0.0001 and the batch size to 32, to optimize the model's training process.

[0069] 2) Pre-training stage

[0070] Collect large-scale cybersecurity-related text data, including but not limited to cybersecurity standard documents, security research papers, detailed records of historical cybersecurity events, security equipment technical manuals, and cybersecurity log data after denoising and annotation. These data cover all aspects of cybersecurity, such as attack types, defense strategies, and security mechanism principles, providing a rich knowledge reserve for the model.

[0071] The collected data is preprocessed and converted into a format suitable for model input, such as segmenting the text into sequences of fixed length and tokenizing them. Then, the preprocessed data is used to pre-train the GPT-4 model. During the pre-training process, distributed training technology is used to distribute the training tasks to multiple GPU nodes for parallel processing to accelerate the training process. At the same time, regularization techniques such as random dropout are used to prevent model overfitting and improve the generalization ability of the model.

[0072] 3) Fine-tuning stage

[0073] 1-LoRA method application

[0074] Determine the model layers that need to be adjusted, such as introducing a low-rank matrix in the middle layer of the GPT-4 model. According to the characteristics of the network security task, the rank of the low-rank matrix is ​​set to 8 (which can be adjusted according to actual conditions). During the fine-tuning process, only the parameters of the low-rank matrix are updated, while other model parameters remain unchanged. This can greatly reduce the number of parameters that need to be trained, reduce computing costs and storage requirements. For example, in the detection task of a specific type of network attack (such as DDoS attack), the LoRA method is used to fine-tune the model so that the model can more accurately identify characteristic patterns related to DDoS attacks.

[0075] 2- Adapter Adjustment Method Application

[0076] An adapter module is inserted after each Transformer layer of the GPT-4 model. The adapter module consists of two fully connected layers with a nonlinear activation function (such as ReLU) in between. The parameter scale of the adapter module is relatively small, for example, it is set to about 1% of the number of parameters of the original model. During fine-tuning, the parameters of the original model are frozen and only the parameters of the adapter module are trained. Through the adapter module, the model can quickly adjust its output representation to adapt to task-specific needs according to different network security tasks (such as malware classification, vulnerability detection, etc.).

[0077] 3- Application of prefix adjustment method

[0078] Design task-specific prefixes for different network security analysis tasks. For example, when performing network traffic analysis tasks, add "traffic analysis:" as a prefix; when performing security event classification tasks, add "event classification:" as a prefix. These prefixes are concatenated with the input text sequence and input into the model. During fine-tuning, the model learns to adjust its processing of the input text according to the instructions of the prefix, so as to better complete specific tasks. Through prefix adjustment, the model can flexibly adapt to the needs of various network security tasks without changing the overall model structure.

[0079] 4- Tips for adjusting the method application

[0080] Design a series of prompt templates related to network security, such as "Please analyze the attack type of the following network security events: [Event description]", "Based on the given network traffic data, determine whether there is an abnormal traffic pattern: [Traffic data]", etc. Parameterize some of the content in these prompt templates, such as replacing "[Event description]" and "[Traffic data]" with learnable embedding vectors. During the fine-tuning process, by optimizing these embedding vectors, the model can generate more accurate and relevant outputs based on different prompts. At the same time, based on the feedback and verification results of the task, continuously iterate and optimize the prompt template to improve the performance of the model in network security tasks.

[0081] 4) Application of mixed precision training technology

[0082] During the model training process, mixed precision training technology is used to combine 16-bit floating point numbers (FP16) and 32-bit floating point numbers (FP32) for calculation. For the forward propagation process of the model, FP16 is used for calculation to reduce memory usage and increase calculation speed. When calculating the gradient in the back propagation, in order to avoid the problem of gradient disappearance or explosion, the gradient is converted to FP32 format for calculation and update. At the same time, the automatic scaling technology is used to dynamically adjust the scaling factor in the FP16 calculation to ensure numerical stability. Through the dynamic loss clipping technology, the clipping threshold is automatically adjusted according to the size of the loss value to prevent gradient explosion. In addition, the optimizer state preservation technology is used to use FP32 to save the optimizer state (such as momentum, variance, etc.) to avoid accumulated numerical errors during training. In addition, the gradient accumulation technology is used to update the model parameters after multiple iterations, further improving the utilization of the GPU and reducing the number of model updates, thereby improving the training efficiency while ensuring the performance of the model.

[0083] 3. Report generation stage

[0084] 1) Report template design

[0085] Design a variety of report templates based on different types of network security reports (such as daily reports, weekly reports, monthly reports, special event reports, etc.) and user needs. Taking the network security daily report template as an example, the template includes the following main parts:

[0086] Basic information: report date, report cycle, person / department generating the report, etc.

[0087] Security Situation Overview: Summarize the overall status of network security for the day in concise language, such as "Today's network security situation is generally stable, no major security incidents have been found, but there are a small amount of abnormal traffic fluctuations."

[0088] Security event details: A detailed list of all security events that occurred that day, including the time the event occurred, the event name (such as "suspected port scan attack"), the severity of the event (high, medium, low), the affected systems / assets, and the event description (such as "At [specific time], a large number of connection requests from [source IP address] were detected, targeting multiple ports within the company's [target IP address range], suspected port scanning behavior.").

[0089] Attack analysis: For each security incident, conduct in-depth attack analysis, including the type of attack (such as network scanning, malware infection, DDoS attack, etc.), the source of the attack (such as the attacker's IP address determined by tracing the source, the name of the attacking organization (if known), the possible motive of the attack (such as stealing data, destroying system availability, etc.), and the vulnerability or weakness exploited by the attack (such as "It is found that the target system has a [software name] vulnerability that has not been updated in time. The attacker may use this vulnerability to attempt an intrusion.").

[0090] Implementation of security protection measures: Record the protection measures taken on the day for various security incidents, such as firewall rule updates, intrusion detection system policy adjustments, isolation and repair of affected systems, etc., and evaluate the effectiveness of the measures.

[0091] Security recommendations: Based on the security situation and event analysis of the day, provide targeted security recommendations, such as "It is recommended to immediately scan all internal systems for [software name] vulnerabilities and update patches in a timely manner." "Strengthen monitoring of traffic from [specific IP address segment] and take blocking measures when necessary."

[0092] Appendix: Attach relevant charts (such as network traffic trend charts, security event statistics charts, etc.), detailed log records (such as raw log fragments of key security events), threat intelligence information (such as the latest discovered malware activity information related to the company), etc. to support the analysis and conclusions in the report.

[0093] 2) Data input and model analysis

[0094] Input the preprocessed and analyzed network security data into the trained model. The model conducts in-depth analysis and understanding of the input data based on the preset template structure and requirements. For example, the model extracts key features of the event from the network security event data, such as the type of attack, time of occurrence, affected systems, and other information, and matches them with the corresponding parts in the template. At the same time, the model uses its understanding of network security knowledge to conduct correlation analysis on events, such as determining whether there is a correlation between different events (such as whether it is a series of attacks launched by the same attacker), the scope and degree of the impact of the event on the entire network security situation, etc.

[0095] 3) Report content generation

[0096] Based on the model's analysis of the data, the content is automatically filled in according to the format of the report template. The model uses its powerful natural language generation capabilities to convert the analysis results into clear, accurate, and easy-to-read text content. For example, when describing the details of a security incident, the model generates a detailed event description paragraph based on the extracted event information, including the background, process, and impact of the incident; when conducting attack analysis, the model combines network security knowledge and analysis results to give professional attack type judgments, source analysis, and vulnerability exploitation explanations; when providing security recommendations, the model generates targeted and actionable recommendation statements based on the current security status and best practices.

[0097] 4) Report optimization and review

[0098] The generated report is first optimized using natural language processing technology to check for grammatical errors, improper use of vocabulary, chaotic sentence structure, and other issues, and automatically correct them. For example, the grammar checker and the error correction function of the language model are used to ensure the fluency and accuracy of the report text. Then, the report is submitted to a professional network security analyst for manual review. The auditor checks the content of the report from a professional perspective, including the accuracy of security incident analysis, the rationality of security recommendations, and the integrity and reliability of the data. The auditor makes necessary modifications and improvements to the report based on the actual situation, such as supplementing missing important information, correcting erroneous analysis conclusions, and optimizing security recommendations. The audited report is the final network security report, which can be used by the management, network security team, and relevant departments of the enterprise or organization to provide strong support for network security decision-making and management.

[0099] Embodiment 2 is an embodiment of the present invention, which provides a network security report auxiliary generation system based on a generative large model, including:

[0100] The data collection and preprocessing module is used to collect network security data, use data cleaning technology to clean, classify and label the collected data, and build a high-quality training data set; the model training and optimization module is used to use the general large model as the basis, and adapt it to the characteristics of the network security field through pre-training and fine-tuning strategies; the report generation module is used to automatically fill in the template content and generate a network security report based on the trained large model, according to the preset report template, combined with the analysis results of the network security data.

[0101] Embodiment 3 is an embodiment of the present invention, which is different from the previous embodiment in that: if the function is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0102] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0103] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0104] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0105] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security report auxiliary generation method based on a generative large model, characterized in that: include: Collect cybersecurity data; Cleaning the network security data, classifying and labeling the cleaned data, and constructing a training data set; A general large model is used as a basic model, and the basic model is trained through pre-training and fine-tuning strategies; wherein a mixed precision training technique is used in the training process; Based on the trained model, according to the preset report template and combined with the analysis results of the network security data, the content of the report template is automatically filled in to generate a network security report.

2. The network security report auxiliary generation method based on the generative large model as claimed in claim 1 is characterized by: The network security data includes network device logs, security device logs and traffic logs; Cleaning the network security data refers to using data cleaning technology to remove erroneous data, invalid data, redundant data, duplicate data and low-quality data; Among them, the data cleaning technology includes rule-based data cleaning technology, which supports multiple rule types and logical operations between rules, has three data repair behaviors of retention, discarding and backfilling, and supports adding, deleting or modifying rules at runtime.

3. The network security report auxiliary generation method based on the generative large model as claimed in claim 2 is characterized by: The data cleaning technology includes a collaborative filtering algorithm, through which a statistical model is established to describe data distribution, score data points, and filter data points with lower quality.

4. The network security report auxiliary generation method based on the generative large model as claimed in claim 3 is characterized by: The data cleaning technology includes a document deduplication technology, which uses at least one of the MD5 technology, the SimHash technology and the SubString technology to identify and remove duplicate documents by calculating the hash value or feature of the document.

5. The network security report auxiliary generation method based on the generative large model as claimed in claim 4 is characterized by: The fine-tuning strategy includes a LoRA method, through which a low-rank matrix is ​​introduced to approximate the adaptive changes of the basic model, thereby reducing the number of parameters to be updated during the fine-tuning process.

6. The network security report auxiliary generation method based on the generative large model as claimed in claim 5 is characterized by: The fine-tuning strategy includes an adapter adjustment method, by which an adapter is inserted into each layer or a specified layer of the base model, and the base model is adapted to a new task or domain by training parameters of the adapter; The fine-tuning strategy includes a prefix adjustment method, by which a trainable, task-specific prefix is ​​added before the input sequence of the base model to achieve fine-tuning for different tasks; The fine-tuning strategy includes a prompt adjustment method, by which a learnable embedding vector is introduced into the input of the base model as a prompt, and the base model is adapted to downstream tasks by adjusting the prompt.

7. The network security report auxiliary generation method based on the generative large model as claimed in claim 6 is characterized by: The network security report includes attack type, attack source, attack target, attack time, security event overview, attacker overview, security operation report, and security recommendations.

8. A network security report auxiliary generation system based on a generative large model, based on the network security report auxiliary generation method based on a generative large model according to any one of claims 1 to 7, characterized in that: include, The data collection and preprocessing module is used to collect network security data, clean, classify and annotate the collected data using data cleaning technology, and build a high-quality training data set; Model training and optimization module, which uses a general large model as a basis to adapt it to the characteristics of the network security field through pre-training and fine-tuning strategies; The report generation module is used to automatically fill in the template content and generate a network security report based on the trained large model, according to the preset report template and the analysis results of the network security data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for assisting in generating a network security report based on a generative large model according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for assisting in generating a network security report based on a generative large model according to any one of claims 1 to 7 are implemented.

Images