A network security report auxiliary generation method based on a generative large model

Abstract

The application discloses a network security report auxiliary generation method based on a generative large model, relates to the technical field of power network security, and comprises the following steps: collecting network security data; cleaning the network security data, classifying and labeling the cleaned data, and constructing a training data set; using a general large model as a basic model, training the basic model through a pre-training and fine-tuning strategy; wherein, a mixed precision training technology is adopted in the training process; based on the trained model, the content of a report template is automatically filled in combination with the analysis result of the network security data according to the preset report template, and a network security report is generated. The application realizes the automatic generation of the network security report, greatly shortens the report generation time, shortens the long time required by the traditional manual mode to the minute level, and improves the work efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power network security, in particular to a network security report auxiliary generation method based on a generative large model. BACKGROUND

[0002] In today's digital age, network security problems are increasingly serious, and enterprises and organizations need to understand network security status in a timely and accurate manner in order to take effective protective measures. Network security reports, as an important information carrier, can comprehensively summarize network security situation, analyze security incidents, and provide decision-making basis.

[0003] However, the traditional network security report generation method mainly relies on manual analysis and writing, and has problems such as low efficiency, low accuracy, and low intelligence. With the development of artificial intelligence technology, generative large models have made significant progress in natural language processing and other fields, providing new ideas and methods for the auxiliary generation of network security reports. SUMMARY

[0004] In view of the above problems, the present application is proposed.

[0005] Therefore, the present application provides a network security report auxiliary generation method based on a generative large model, which can solve the problems mentioned in the background art.

[0006] To solve the above technical problems, the present application provides the following technical scheme: a network security report auxiliary generation method based on a generative large model, comprising: collecting network security data;

[0007] Cleaning the network security data, classifying and labeling the cleaned data, and constructing a training data set;

[0008] Using a general large model as a base model, training the base model through pre-training and fine-tuning strategies; wherein, during the training process, hybrid precision training technology is adopted;

[0009] Based on the trained model, according to the preset report template, combining the analysis results of the network security data, automatically filling the content of the report template, and generating a network security report.

[0010] As a preferred scheme of the network security report auxiliary generation method based on a generative large model, wherein: the network security data includes network device logs, security device logs and traffic logs;

[0011] Cleaning the network security data means using data cleaning technology to remove error data, invalid data, redundant data, duplicate data and low-quality data;

[0012] Among them, the data cleaning technology includes rule-based data cleaning technology, which supports multiple rule types and logical operations between rules, has three data repair behaviors of retention, discarding and backfilling, and supports adding, deleting or modifying rules at runtime.

[0013] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, the data cleaning technology includes a collaborative filtering algorithm, through which a statistical model is established to describe the data distribution, score the data points, and filter out low-quality data points.

[0014] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, the data cleaning technology includes a document deduplication technology, which adopts at least one of MD5 technology, SimHash technology and SubString technology to identify and remove duplicate documents by calculating the hash value or feature of the document.

[0015] As a preferred solution of the network security report auxiliary generation method based on the generative large model described in the present invention, the fine-tuning strategy includes the LoRA method, which introduces a low-rank matrix to approximate the adaptive changes of the basic model, thereby reducing the number of parameters to be updated during the fine-tuning process.

[0016] As a preferred embodiment of the method for assisting in generating cybersecurity reports based on a generative large model according to the present invention, the fine-tuning strategy includes an adapter adjustment method, by which an adapter is inserted into each layer or a specified layer of the base model, and the base model is adapted to new tasks or domains by training the parameters of the adapter;

[0017] The fine-tuning strategy includes a prefix adjustment method, by which a trainable, task-specific prefix is ​​added before the input sequence of the base model to achieve fine-tuning for different tasks;

[0018] The fine-tuning strategy includes a hint adjustment method, by which a learnable embedding vector is introduced into the input of the base model as a hint, and the base model is adapted to the downstream task by adjusting the hint.

[0019] As a preferred solution of the network security report auxiliary generation method based on the generative big model described in the present invention, the network security report includes the attack type, attack source, attack target, attack time, security event overview, attacker overview, security operation report, and security recommendations.

[0020] To further solve the above technical problems, the present invention provides the following technical solutions: a network security report auxiliary generation system based on a generative big model, including: a data acquisition and preprocessing module: used to collect network security data, use data cleaning technology to clean, classify and label the collected data, and build a high-quality training data set; a model training and optimization module: used to use a general big model as a basis, through pre-training and fine-tuning strategies, to adapt it to the characteristics of the network security field; a report generation module: used to automatically fill in the template content based on the trained big model, according to the preset report template, combined with the analysis results of the network security data, to generate a network security report.

[0021] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, it implements the steps of the above-mentioned method for auxiliary generation of network security reports based on a generative large model.

[0022] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the above-mentioned method for assisting in generating a network security report based on a generative large model are implemented.

[0023] The beneficial effects of the present invention are as follows: 1. It realizes the automatic generation of network security reports, greatly shortening the report generation time from the long time required by traditional manual methods to minutes, thereby improving work efficiency; 2. It improves accuracy, based on the in-depth analysis and understanding of massive network security data by generative big models, the generated report content is more accurate and reliable, and human errors are reduced; 3. It has a high degree of intelligence and can automatically identify and analyze network security incidents, provide intelligent security recommendations, and provide more powerful support for network security operations; 4. It has strong adaptability and can adapt to different network security scenarios and needs by fine-tuning strategies, with good versatility and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 1 is a schematic diagram of data collection and preprocessing of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0026] Figure 2 This is a data cleaning diagram of a method for assisting in generating a network security report based on a generative large model according to an embodiment of the present application;

[0027] Figure 3 This is a document deduplication technology operation process of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0028] Figure 4 This is a schematic diagram of model training and optimization of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application;

[0029] Figure 5 This is a schematic diagram of the application deployment of a network security report auxiliary generation method based on a generative large model according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0031] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0032] Example 1, with reference to Figures 1 to 5 , as an embodiment of the present invention, provides a network security report auxiliary generation method based on a generative large model.

[0033] 1. Data collection and preprocessing stage

[0034] 1) Data Collection

[0035] 1-Internet data collection.

[0036] We meticulously build customized web crawlers targeting key data sources such as authoritative cybersecurity websites, well-known security forums, and professional technical blogs. When developing these crawlers, we carefully consider the website's structure and data distribution, and utilize advanced web parsing techniques, such as BeautifulSoup and the lxml library, to accurately locate and extract useful information from web pages.

[0037] For structured data, such as tabular data in security vulnerability databases, crawlers are used to accurately identify and convert it into a format that is easy to process, such as CSV files, to ensure data integrity and accuracy. For unstructured data, such as detailed attack analysis articles posted by security experts on forums and in-depth defense strategy explanations in technical blogs, a meticulous text cleaning process is used to remove HTML tags, useless advertising information, confusing characters, and irrelevant redundant content, converting it into a pure text format for in-depth analysis and processing.

[0038] At the same time, the crawler's crawling frequency and depth should be appropriately set to avoid excessive traffic pressure on target websites while ensuring comprehensive and up-to-date cybersecurity information is obtained. For example, for frequently updated security news websites, a higher crawling frequency should be set to obtain real-time security updates; for in-depth technical analysis blogs, the crawling depth should be appropriately increased to uncover more valuable expertise.

[0039] 2- Commercial security data procurement and integration

[0040] Establish long-term, stable, and in-depth partnerships with reputable and experienced data providers in the cybersecurity data field. Initially, conduct in-depth communication and needs research with data providers. Based on the project's specific needs, application scenarios, and anticipated goals for assisting with cybersecurity report generation, we jointly develop a detailed and precise data procurement plan.

[0041] Clarify the specific types of commercial security data required, such as high-precision real-time threat intelligence data, which must cover the behavioral characteristics of various emerging malware worldwide, the complex tactics and procedures (TTPs) of attack organizations, detailed exploitation information of zero-day vulnerabilities, and potential threats to critical network assets; comprehensive and in-depth security incident case data, ensuring that each case contains a complete incident background, a detailed description of the attack process down to each step (including precise tracking of the attack path, detailed technical analysis of the exploited vulnerabilities, the propagation method and infection scope of the malware, etc.), an accurate and reliable impact assessment (involving precise definition of the scope of the affected systems, precise statistics of the duration of business interruption, detailed quantification of the scale of data leakage, etc.), as well as effective response measures that have been verified in practice and a summary of lessons learned that are of profound reference value.

[0042] In the data access process, a strict and multi-dimensional data quality audit mechanism is established. First, through comprehensive comparison with existing high-quality and reliable internal data samples, the consistency and accuracy of the data are checked. Second, professional data analysis algorithms are used to deeply check the integrity and logic of the data, ensuring that the data meets the expected requirements in all dimensions. In addition, internal senior network security experts are invited to conduct manual audits of the data, relying on their rich professional experience and sharp insights to assess and judge the authenticity, reliability, and relevance to actual business scenarios of the data. Through this comprehensive data quality audit mechanism, the commercial security data purchased is accurate, unbiased, and highly practical, providing a solid data foundation for subsequent analysis and decision-making.

[0043] 3. Internal data collection of power system

[0044] Professional and efficient data collection agents are carefully deployed on the core network nodes and key security devices of the power system. These agents have strong real-time monitoring and data collection capabilities, and can comprehensively collect massive log data, accurate alarm information, and detailed traffic data generated by various network devices such as routers, switches, firewalls, intrusion detection / prevention systems, and power monitoring systems.

[0045] For network device logs, not only the subtle changes in device interface status, real-time updates of routing tables, establishment and disconnection of network connections, and other basic events are recorded, but also detailed configuration information and comprehensive operating parameters of the device are collected, such as router routing protocol configuration, switch VLAN settings, firewall access control policies, etc., to deeply understand the running status of network devices from multiple angles. Security device logs focus on various security events detected by the device, including detailed characteristics of intrusion attempts, early signs of malware infection, accurate identification of abnormal traffic patterns, etc., while accurately recording the precise time of event occurrence, source IP address, destination IP address, accurate identification of attack type, and detailed assessment of threat level, etc. Key attributes. Traffic data collection covers comprehensive information of network traffic, including source address, destination address, port number, protocol type, packet size, transmission time, and traffic direction, etc. Through deep analysis of traffic data, potential network scanning behavior, data leakage risk, denial of service attack signs, and other serious security threats can be discovered in a timely manner.

[0046] To ensure the integrity and confidentiality of collected data during transmission, advanced data encryption technologies, such as the AES encryption algorithm, are used to encrypt the collected data and prevent it from being stolen or tampered with during transmission. At the same time, a strict data verification mechanism is established at the data receiving end, using hash algorithms (such as SHA-256) to perform integrity checks on the received data to ensure that the data is not lost or damaged during transmission. Furthermore, the collected internal power system data is deeply integrated with other relevant data sources, such as real-time operating data from the power production control system (including the operating status of power generation equipment and real-time parameters of power transmission), user authentication and access records from the power marketing system (such as user login information and operation permission change records), and command execution status from the power dispatching system (such as the issuance of dispatching commands and feedback on execution results). Through advanced data fusion technology, a comprehensive, three-dimensional, and dynamic view of power network security data is constructed, providing a richer, more accurate, and more relevant data foundation for subsequent in-depth analysis and precise decision-making.

[0047] 2) Data cleaning:

[0048] 1-Implementation of rule-based data cleaning technology

[0049] Develop a detailed and highly targeted cleaning rule system for different types of network security data. For network device logs, strictly check whether IP addresses strictly comply with legal IP address format specifications, whether timestamps are accurate within a reasonable time range and formatted in accordance with international standards (such as ISO8601), whether log messages fully contain key information and are free of garbled or unrecognizable characters, and ensure that log messages are grammatically correct and semantically clear. For security device logs, carefully verify whether alarm levels are accurate and consistent with the actual threat level, whether attack type identification is accurate and strictly adheres to industry-recognized standard classification systems, and whether event descriptions are clear and unambiguous, without vague or ambiguous expressions, and accurately convey the key information of the incident. For traffic data, thoroughly check whether packet sizes are within a reasonable range, whether port numbers are within a legal port number range, and whether protocol types are known and valid network protocols. Accurately identify and flag outliers in traffic data (such as oversized or undersized packets, unusual port number usage, etc.).

[0050] When erroneous values ​​or inconsistencies are discovered in the data, they are scientifically processed according to pre-defined repair strategies. For erroneous data whose correct values ​​can be determined by referencing relevant contextual information, network topology, device configuration files, or historical data, such as obvious spelling errors or malformed IP addresses, inconsistent timestamp formats, etc., automatic corrections are performed. For erroneous data whose correct values ​​cannot be determined, the appropriate handling method is selected based on the importance of the data, the impact on subsequent analysis, and the actual needs of the business. For example, errors in critical business data are clearly marked as anomalies and immediately trigger a manual review process, where experienced professionals conduct in-depth investigation and repair. For errors in non-critical data, if the number of erroneous data is small and has little impact on the overall analysis, they can be directly deleted or simply marked for appropriate processing in subsequent analysis. If the number of erroneous data is large and may affect the accuracy of the analysis results, the distribution patterns and characteristics of the erroneous data are further analyzed, and statistical methods such as data interpolation and mean substitution are attempted to make approximate repairs, but the repair process and basis are recorded at the same time for subsequent tracing and evaluation.

[0051] A flexible rule management mechanism is built to support users to dynamically add, delete, or modify cleaning rules based on actual conditions during runtime. When the power system network architecture changes (such as adding new network devices or adjusting the network topology), security equipment is upgraded or updated (resulting in changes in log formats or alarm rules), or business needs change (such as focusing on new safety indicators or data features), users can quickly and easily adjust the cleaning rules through a user-friendly user interface or configuration file, ensuring that the data cleaning process is always highly consistent with the actual business environment and needs, thereby continuously providing high-quality data cleaning services.

[0052] 2-Application of collaborative filtering algorithm

[0053] We collect a large number of carefully labeled, high-quality network security data samples. These samples cover a wide range of normal and abnormal network security data types, and each sample is accompanied by accurate and detailed quality labels, such as "high quality (noise-free, complete, and accurate)", "low quality (contains a small amount of noise, some information is missing, or there are minor errors)", and "suspected anomaly (data characteristics significantly deviate from normal patterns, but the specific problem cannot be determined)". Based on this rich and diverse data samples, we train a highly accurate quality assessment model. During training, the model deeply learns the inherent relationship between various complex features in the data (such as network traffic fluctuation patterns, packet size distribution, and the frequency and type combination of security device alarms) and quality labels. For example, for network traffic data, the model learns the characteristic patterns of normal traffic such as traffic size, traffic change rate, protocol distribution in different time periods and different business scenarios, as well as the unique characteristic patterns of abnormal traffic (such as DDoS attack traffic, malware communication traffic, etc.), thereby establishing a mapping relationship between traffic data characteristics and quality labels; for security equipment alarm data, the model learns the frequency distribution of alarms, the combination pattern of alarm types, the correlation with other related events (such as network traffic anomalies, error records in system logs, etc.), and other characteristics that affect quality, thereby constructing an effective model between alarm data characteristics and quality assessment.

[0054] The trained quality assessment model is applied to the large-scale data sets actually collected. The model performs a comprehensive and detailed quality score on each piece of data, and conducts a comprehensive evaluation based on multiple dimensions such as the similarity between the data and the learned high-quality data patterns and the degree of matching with abnormal data features. For example, for a piece of network traffic data, the model will analyze its traffic size, change trends, protocol usage and other characteristics for similarity with normal traffic patterns, as well as whether there are features similar to known attack traffic patterns, so as to give an accurate quality score. According to the set reasonable quality threshold, low-quality data points with scores below the threshold are accurately filtered out. At the same time, in order to adapt to the dynamic changes in the network security environment (such as the emergence of new attack methods, changes in data patterns caused by business system upgrades, etc.), the quality assessment model is regularly updated and optimized using the latest labeled data to ensure that the model can continuously and accurately assess data quality and always provide a reliable data foundation for subsequent analysis.

[0055] 3-Document deduplication technology operation process

[0056] When using MD5 technology to deduplicate documents, the MD5 hash value of each document is efficiently calculated, and these hash values ​​are stored in an optimized data structure, such as a hash table, to achieve fast search and comparison. When processing a new document, its MD5 hash value is quickly calculated and efficiently searched in the hash table. If the hash values ​​are the same, it is highly suspected that the document is duplicated, and further detailed content comparison (such as comparing the key parts, summaries or feature vectors of the document, etc.) is performed to confirm whether it is truly duplicated; if different, the document is retained. In order to improve computational efficiency, especially for large documents, a strategy of calculating MD5 hash values ​​in blocks is adopted. The document is divided into multiple smaller blocks, and the MD5 hash value of each block is calculated separately. Then, the hash values ​​of these blocks are combined through a specific algorithm to obtain the final MD5 hash value of the document. This can significantly reduce computing time and memory usage while maintaining a high deduplication accuracy.

[0057] When using SimHash technology, a representative low-dimensional vector representation is generated for each document, and each bit of the vector is based on the semantic features of a specific word or phrase in the document. The similarity between vectors is calculated to accurately determine whether the documents are similar or duplicate. When calculating the similarity, an efficient vector similarity calculation algorithm, such as the cosine similarity algorithm, is used to quickly and accurately evaluate the degree of similarity between documents. A reasonable similarity threshold is set. When the SimHash vector similarity of two documents exceeds the threshold, they are considered to be similar or duplicate documents and require further review or processing; if the similarity is lower than the threshold, the document is retained. At the same time, in order to improve the performance and adaptability of SimHash technology, the parameters and strategies of vector generation are flexibly adjusted according to the type, length and application scenario of the document, such as selecting different words or phrases as the basis of the vector, adjusting the dimension of the vector, etc., to optimize the deduplication effect.

[0058] When using SubString technology, documents are cleverly segmented into multiple meaningful substrings and stored in a carefully designed index structure for fast retrieval. When checking for duplicates in a new document, all its substrings are efficiently extracted and quickly searched in the index. If a large number of identical substrings exceeds a certain reasonable ratio, the document is considered a possible duplicate and further detailed comparison or appropriate processing is performed based on specific business rules. Furthermore, the substring length and selection strategy are dynamically adjusted based on the document length, content importance, and application requirements. For example, for longer documents, the substring length can be appropriately increased to improve deduplication accuracy, but this may increase computational and storage costs. For scenarios with high real-time requirements, the substring length can be appropriately shortened to speed up processing, but this may slightly reduce deduplication accuracy. This flexible adjustment strategy achieves an optimal balance between deduplication accuracy and efficiency to meet the needs of different business scenarios.

[0059] 3) Data classification and labeling:

[0060] 1-Implementation of large-scale intelligent classification method based on Prompt project

[0061] From the vast amount of unlabeled samples, we carefully selected a small number of highly representative and diverse labeled samples as a valuable reference set. These labeled samples cover a wide range of network security data, including attack data (including DDoS attacks, SQL injection attacks, malware infection data, etc.), normal network traffic data, normal operation data of security devices, network configuration information data, etc., ensuring that the reference set can fully reflect the data characteristics and patterns in the field of network security.

[0062] For each type of data, we conduct in-depth research on its unique characteristics and patterns, and develop detailed and accurate classification rules and labeling standards. For example, for DDoS attack data, characteristics may include connection requests from a large number of different source IP addresses in a short period of time, a concentration of target IP addresses and abnormally large traffic, and data packet content with specific attack characteristics (such as specific malicious instructions or request formats). For SQL injection attack data, characteristics manifest as malicious SQL statement fragments in user input or network requests, such as special character combinations (such as 'or1=1--) and frequent attempts to modify SQL query statements. For normal network traffic data, its characteristics are generally compliance with network protocol specifications, stable traffic patterns within a reasonable range, and the use of source and destination IP addresses and ports that conform to normal business logic. For normal operation data of security devices, this includes records of normal device startup and shutdown, regular health check information, and normal configuration update records. For network configuration information data, specific formats and grammatical rules are followed, such as routing table entries in router configuration and access control rules in firewall configuration.

[0063] Selected reference samples are fed into a trillion-scale model. Leveraging the model's powerful semantic understanding and pattern recognition capabilities, the model conducts in-depth analysis of the reference samples, extracting key features and semantic representations of various data types. For example, by learning from a large number of DDoS attack samples, the model can automatically identify attack-related traffic characteristics, packet structure features, and time series features. These features are then converted into semantic representations understandable by the model, forming a feature vector space specific to DDoS attacks. Similarly, corresponding feature vector spaces are constructed for other types of data, such as SQL injection attacks and normal traffic, thereby establishing a semantically based classification model.

[0064] Massive amounts of sample data to be classified are fed into a pre-trained large model based on the Prompt project. Based on the learned feature vector spaces of each type of data, the model calculates the similarity between the sample to be classified and the feature vectors of each category. For example, by calculating cosine similarity or other appropriate similarity metrics, the model determines the proximity of the sample to be classified to the feature vector spaces of DDoS attacks, SQL injection attacks, and normal traffic. Based on the similarity, the sample to be classified is assigned to the most similar category, achieving automatic classification.

[0065] During the classification process, the model continuously learns and optimizes the classification rules. When encountering samples with inaccurate or uncertain classification, the model interacts with the feedback mechanism of artificial labeling. For example, samples with low confidence (e.g., similarity close to the classification threshold) in the classification results are submitted to artificial experts for review and labeling. Experts correct the model's classification errors based on their professional knowledge and experience, and provide correct labels to the model. Based on these feedbacks, the model further adjusts the classification rules and feature vector space to improve the accuracy and reliability of classification. At the same time, as new network security data continues to emerge and network attack methods continue to evolve, periodically update the reference sample set to include new attack types or data patterns in the training data, so that the model can adapt to changes in the network security environment in a timely manner and maintain the effectiveness of classification.

[0066] II. Model training and optimization phase

[0067] 1) Model selection and basic settings

[0068] After evaluating the performance and adaptability of multiple general-purpose large models, GPT-4 is selected as the base model (this is only an example, and other suitable models can be selected according to requirements). GPT-4 performs well in natural language understanding and generation capabilities, and can better handle complex text data in the field of network security. Before use, necessary initialization settings are made for the model, including adjusting the model's hyperparameters, such as setting the learning rate initial value to 0.0001 and the batch size to 32, to optimize the model's training process.

[0069] 2) Pre-training phase

[0070] Collect large-scale network security related text data, including but not limited to network security standard documents, security research papers, detailed records of historical network security events, security device technical manuals, and network security log data after noise removal and labeling processing, etc. These data cover various aspects of network security, such as attack types, defense strategies, security mechanism principles, etc., providing rich knowledge reserves for the model.

[0071] Preprocess the collected data to convert it into a format suitable for model input, such as splitting the text into fixed-length sequences and performing tokenization processing. Then, use the preprocessed data to pre-train the GPT-4 model. During the pre-training process, use distributed training technology to distribute the training task to multiple GPU nodes for parallel processing to speed up the training process. At the same time, use regularization techniques such as Dropout to prevent model overfitting and improve the model's generalization ability.

[0072] 3) Fine-tuning phase

[0073] 1-LoRA method application

[0074] Identify the model layers that need adjustment, such as introducing a low-rank matrix into the middle layer of the GPT-4 model. Based on the characteristics of the network security task, the rank of the low-rank matrix is ​​set to 8 (which can be adjusted according to actual conditions). During fine-tuning, only the parameters of the low-rank matrix are updated, while other model parameters remain unchanged. This can significantly reduce the number of parameters that need to be trained, lowering computational costs and storage requirements. For example, in the task of detecting specific types of network attacks (such as DDoS attacks), the LoRA method is used to fine-tune the model, enabling the model to more accurately identify characteristic patterns related to DDoS attacks.

[0075] 2- Adapter Adjustment Method Application

[0076] An adapter module is inserted after each Transformer layer in the GPT-4 model. The adapter module consists of two fully connected layers with a nonlinear activation function (such as ReLU) in between. The adapter module's parameter size is relatively small, for example, set to approximately 1% of the original model's parameters. During fine-tuning, the original model's parameters are frozen, and only the adapter module's parameters are trained. This adapter module enables the model to rapidly adapt its output representation to the specific needs of various cybersecurity tasks (such as malware classification and vulnerability detection).

[0077] 3-Prefix adjustment method application

[0078] Task-specific prefixes are designed for different network security analysis tasks. For example, when performing network traffic analysis, "traffic analysis:" is added as a prefix; when performing security event classification, "event classification:" is added as a prefix. These prefixes are concatenated with the input text sequence and then fed into the model. During fine-tuning, the model learns to adjust its processing of the input text based on the prefixes, thereby better completing the specific task. This prefix adjustment allows the model to flexibly adapt to the needs of various network security tasks without changing the overall model structure.

[0079] 4- Tips for adjusting the method application

[0080] Design a series of cybersecurity-related prompt templates, such as "Please analyze the attack type of the following cybersecurity incident: [incident description]" and "Based on the given network traffic data, determine whether there is an abnormal traffic pattern: [traffic data]." Parameterize some of the content in these prompt templates, for example, replacing "[incident description]" and "[traffic data]" with learnable embedding vectors. During fine-tuning, by optimizing these embedding vectors, the model can generate more accurate and relevant outputs based on different prompts. Furthermore, based on task feedback and verification results, continuously iterate and optimize the prompt templates to improve the model's performance in cybersecurity tasks.

[0081] 4) Application of mixed precision training technology

[0082] During model training, mixed-precision training technology is employed, combining 16-bit floating-point (FP16) and 32-bit floating-point (FP32) calculations. FP16 is used for forward propagation to reduce memory usage and increase computational speed. During backward propagation, gradients are converted to FP32 format for calculation and update to prevent vanishing or exploding gradients. Automatic scaling is employed to dynamically adjust the scaling factor in FP16 calculations to ensure numerical stability. Dynamic loss clipping automatically adjusts the clipping threshold based on the loss value to prevent gradient explosion. Furthermore, optimizer state preservation is employed to preserve optimizer state (such as momentum and variance) in FP32 format, preventing the accumulation of numerical errors during training. Furthermore, gradient accumulation is employed to update model parameters only after multiple iterations, further improving GPU utilization and reducing the number of model updates, thereby enhancing training efficiency while maintaining model performance.

[0083] 3. Report generation stage

[0084] 1) Report template design

[0085] Design a variety of report templates based on the different types of network security reports (such as daily reports, weekly reports, monthly reports, special event reports, etc.) and user needs. Taking the network security daily report template as an example, the template includes the following main parts:

[0086] Basic information: report date, report cycle, report generator / department, etc.

[0087] Security Situation Overview: Use concise language to summarize the overall network security status of the day, such as "Today's network security situation is generally stable. No major security incidents have been found, but there are a few abnormal traffic fluctuations."

[0088] Security event details: A detailed list of all security events that occurred that day, including the time the event occurred, the event name (such as "suspected port scan attack"), the event severity (high, medium, low), the affected systems / assets, and the event description (such as "At [specific time], a large number of connection requests from [source IP address] were detected, targeting multiple ports within the company's [target IP address range], suspected port scanning behavior.").

[0089] Attack analysis: For each security incident, conduct in-depth attack analysis, including the attack type (such as network scanning, malware infection, DDoS attack, etc.), the attack source (such as the attacker's IP address determined through tracing analysis, the name of the attacking organization (if known), the possible motivation of the attack (such as stealing data, destroying system availability, etc.), and the vulnerability or weakness exploited by the attack (such as "It was found that the target system has a [software name] vulnerability that has not been updated in a timely manner. The attacker may exploit this vulnerability to attempt an intrusion.").

[0090] Implementation of security protection measures: Record the protection measures taken for various security incidents on the day, such as firewall rule updates, intrusion detection system policy adjustments, isolation and repair of affected systems, etc., and evaluate the effectiveness of the measures.

[0091] Security Recommendations: Based on the security situation and event analysis of the day, targeted security recommendations are provided, such as "Immediately scan all internal company systems for vulnerabilities in [software name] and update patches promptly." "Strengthen monitoring of traffic from [specific IP address segment] and take blocking measures if necessary."

[0092] Appendix: Attach relevant charts (such as network traffic trend charts, security event statistics charts, etc.), detailed log records (such as raw log fragments of key security events), threat intelligence information (such as the latest discovered malware activity information related to the company), etc. to support the analysis and conclusions in the report.

[0093] 2) Data input and model analysis

[0094] The preprocessed and analyzed cybersecurity data is fed into the trained model. The model then conducts in-depth analysis and understanding of the input data based on the pre-set template structure and requirements. For example, the model extracts key characteristics of cybersecurity incident data, such as the attack type, time of occurrence, and affected systems, and matches these characteristics with the corresponding features in the template. Furthermore, the model leverages its understanding of cybersecurity knowledge to perform correlation analysis on incidents, such as determining whether there are connections between different incidents (e.g., whether they are a series of attacks initiated by the same attacker) and the scope and extent of the incident's impact on the overall cybersecurity situation.

[0095] 3) Report content generation

[0096] Based on the analysis results of the data by the model, the content is automatically filled in according to the format of the report template. The model uses its powerful natural language generation capability to convert the analysis results into clear, accurate and easy-to-read text content. For example, when describing the details of a security event, the model generates a detailed event description paragraph based on the extracted event information, including the background, process and impact of the event; when conducting attack analysis, the model combines network security knowledge and analysis results to give professional attack type judgment, source analysis and vulnerability exploitation explanation; when providing security recommendations, the model generates targeted and actionable recommendation sentences based on the current security situation and best practice experience.

[0097] 4) Report optimization and review

[0098] The generated report is first subjected to preliminary optimization by natural language processing technology, checking for grammatical errors, improper use of vocabulary, chaotic sentence structure, etc., and automatically correcting. For example, using grammar checking tools and language model correction functions to ensure the fluency and accuracy of the report text. Then, the report is submitted to professional network security analysts for manual review. Reviewers check the content of the report from a professional perspective, including the accuracy of security event analysis, the rationality of security recommendations, the completeness and reliability of data, etc. Reviewers make necessary modifications and improvements to the report based on actual conditions, such as supplementing missing important information, correcting incorrect analysis conclusions, optimizing security recommendations, etc. The report after review is the final network security report, which can be used by the management, network security team and relevant departments of the enterprise or organization, providing strong support for network security decision-making and management.

[0099] Embodiment 2 provides a network security report auxiliary generation system based on a generative large model, including:

[0100] A data acquisition and preprocessing module is used to collect network security data, and data cleaning techniques are used to clean, classify and label the collected data to build a high-quality training data set; a model training and optimization module is used to use a general large model as a basis, and through pre-training and fine-tuning strategies, it is adapted to the characteristics of the network security field; a report generation module is used to generate a network security report based on the trained large model, according to the pre-set report template, and combining the analysis results of the network security data, automatically filling in the template content.

[0101] Example 3 is an embodiment of the present invention, which is different from the previous embodiment in that if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0102] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0103] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0104] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0105] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security report auxiliary generation method based on a generative large model, characterized in that: include: Collect cybersecurity data; Cleaning the network security data, classifying and labeling the cleaned data, and constructing a training data set; Using a general large model as a base model, the base model is trained through pre-training and fine-tuning strategies; wherein a mixed precision training technique is used in the training process; Based on the trained model, according to the preset report template and combined with the analysis results of the network security data, the content of the report template is automatically filled in to generate a network security report; The fine-tuning strategy includes an adapter adjustment method, by which an adapter is inserted into each layer or a specified layer of the base model, and the base model is adapted to a new task or domain by training parameters of the adapter; The fine-tuning strategy includes a prefix adjustment method, by which a trainable, task-specific prefix is ​​added before the input sequence of the base model to achieve fine-tuning for different tasks; The fine-tuning strategy includes a prompt adjustment method, by which a learnable embedding vector is introduced into the input of the base model as a prompt, and the base model is adapted to the downstream task by adjusting the prompt; To ensure the integrity and confidentiality of collected data during transmission, advanced data encryption technology is used, a strict data verification mechanism is established at the data receiving end, and a hash algorithm is used to check the integrity of the received data to ensure that the data is not lost or damaged during transmission. The collected internal data of the power system is deeply integrated with other relevant data sources. Through advanced data fusion technology, a comprehensive, three-dimensional and dynamic view of power network security data is constructed, providing a richer, more accurate and relevant data foundation for subsequent in-depth analysis and precise decision-making; Develop a detailed and highly targeted cleaning rule system for different types of network security data. For network device logs, strictly check whether the IP address strictly complies with the legal IP address format specifications, whether the timestamp is accurate within a reasonable time range and the format uniformly follows international standards, whether the log message contains complete key information and is not mixed with garbled or unrecognizable characters, and at the same time ensure that the grammatical structure of the log message is correct and the semantics are clear. For security device logs, carefully verify whether the alarm level is accurate and consistent with the actual threat level, whether the attack type identification is accurate and strictly complies with the industry-recognized standard classification system, whether the event description is clear and unambiguous, does not contain vague or ambiguous expressions, and can accurately convey the key information of the event. For traffic data, comprehensively check whether the packet size is within a reasonable value range, whether the port number is within a legal port number range, and whether the protocol type is a known and valid network protocol. At the same time, accurately identify and mark outliers in the traffic data; We collect a large number of carefully labeled, high-quality network security data samples. These samples cover a variety of normal and abnormal network security data types, and each sample is accompanied by accurate and detailed quality labels. Based on this rich and diverse data sample, we train a highly accurate quality assessment model. During the training process, the model deeply learns the inherent relationship between various complex features in the data and quality labels, thereby establishing a mapping relationship between traffic data features and quality labels. For security device alarm data, the model learns the impact of characteristics such as alarm frequency distribution, combination patterns of alarm types, and correlation with other related events on quality, thus building an effective model between alarm data characteristics and quality assessment. During the model training process, mixed precision training technology is adopted, combining 16-bit floating-point numbers and 32-bit floating-point numbers for calculation. For the forward propagation process of the model, FP16 calculation is used to reduce memory usage and improve calculation speed. When calculating the gradient during back propagation, in order to avoid the problem of gradient disappearance or explosion, the gradient is converted to FP32 format for calculation and update. At the same time, automatic amplification and scaling technology is used to dynamically adjust the scaling factor in FP16 calculation to ensure numerical stability. Through dynamic loss clipping technology, the clipping threshold is automatically adjusted according to the size of the loss value to prevent gradient explosion. In addition, the optimizer state retention technology is used to use FP32 to save the optimizer state to avoid accumulated numerical errors during training. In addition, the gradient accumulation technology is used to update the model parameters after multiple iterations, further improving the utilization of the GPU and reducing the number of model updates, thereby improving training efficiency while ensuring model performance.

2. The network security report auxiliary generation method based on a generative large model according to claim 1 is characterized by: The network security data includes network device logs, security device logs and traffic logs; Cleaning the network security data refers to using data cleaning technology to remove erroneous data, invalid data, redundant data, duplicate data and low-quality data; Among them, the data cleaning technology includes rule-based data cleaning technology, which supports multiple rule types and logical operations between rules, has three data repair behaviors of retention, discarding and backfilling, and supports adding, deleting or modifying rules at runtime.

3. The network security report auxiliary generation method based on a generative large model according to claim 2 is characterized by: The data cleaning technology includes a collaborative filtering algorithm, through which a statistical model is established to describe data distribution, score data points, and filter out low-quality data points.

4. The network security report auxiliary generation method based on a generative large model according to claim 3 is characterized by: The data cleaning technology includes a document deduplication technology, which uses at least one of MD5 technology, SimHash technology and SubString technology to identify and remove duplicate documents by calculating the hash value or feature of the document.

5. The network security report auxiliary generation method based on a generative large model according to claim 4 is characterized in that: The fine-tuning strategy includes the LoRA method, which introduces a low-rank matrix to approximate the adaptive changes of the basic model and reduce the number of parameters to be updated during the fine-tuning process.

6. The method for assisting in generating network security reports based on a generative large model according to claim 5, characterized in that: The network security report includes attack type, attack source, attack target, attack time, security incident overview, attacker overview, security operation report, and security recommendations.

7. A network security report auxiliary generation system based on a generative large model, based on the network security report auxiliary generation method based on a generative large model according to any one of claims 1 to 6, characterized in that: include, The data collection and preprocessing module is used to collect network security data and use data cleaning technology to clean, classify and label the collected data to build a high-quality training data set; The model training and optimization module is used to use a general large model as a basis and adapt it to the characteristics of the network security field through pre-training and fine-tuning strategies; The report generation module is used to automatically fill in the template content and generate a network security report based on the trained large model, the preset report template, and the analysis results of the network security data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for assisting in generating a network security report based on a generative large model according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for assisting in generating a network security report based on a generative large model according to any one of claims 1 to 6 are implemented.

Images