Network security equipment management method based on generative large model and intelligent plug-in
By adopting a network security device management method based on generative large models and intelligent plug-in in the digital grid system, the problem that existing technology is difficult to deal with complex security threats is solved, efficient network security analysis and coordinated defense are achieved, and the network security protection level of the digital grid is significantly improved.
Patent Information
- Application Number
- CN202411743007.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-05-02
AI Technical Summary
Existing cybersecurity protection technologies are difficult to effectively deal with the complex security threats faced by modern digital grid systems, especially in terms of device-level security and the vulnerability of IoT devices. Traditional methods lack resilience and overall security decline.
The network security device management method based on generative large models and intelligent plug-in is adopted. By integrating the general knowledge base, network security knowledge base and power network security attack and defense data, a power network security analysis model base is built, and security devices are connected through intelligent plug-in mechanisms to achieve coordinated and coordinated handling and intelligent analysis decision-making.
It significantly improves the efficiency of network security analysis, improves the ability to respond to complex threats, enhances the network security protection level of digital power grids, and can be flexibly applied to digital power grid systems of different sizes and types.
Smart Images
Figure CN119921973A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to a network security device management method based on a generative large model and an intelligent plug-in type. Background Art
[0002] With the continuous advancement of digital grid technology, the intelligence and automation level of the power system has been significantly improved, especially in energy management, load forecasting, power dispatching and power distribution. By using big data, cloud computing, artificial intelligence and IoT technology, the digital grid can not only monitor the power operation status in real time, but also automatically adjust the power supply to optimize energy utilization and improve the efficiency of power distribution. In addition, many important power companies have widely adopted cloud computing-based data centers and grid management platforms, thereby improving the intelligence and accuracy of power operations. However, with the continuous expansion of the scale of digital grids, the complexity of equipment and the wide connectivity of the network have also led to increasingly prominent security issues. Digital grid systems usually involve a large number of sensors, terminal devices, smart meters and data processing platforms. The high integration and interconnection of these components make the security risks of the system grow exponentially, especially in the interaction between IoT devices, data centers and grid management platforms. How to ensure system security and prevent external attacks has become the core challenge facing the current digital grid.
[0003] Although existing network security protection technologies, such as network isolation, firewalls, and intrusion detection systems, have ensured the safe operation of power grids to a certain extent, they are no longer able to effectively cope with the complex security threats faced by modern digital power grid systems. First, traditional network isolation and boundary protection technologies mainly rely on static policy settings, which are insufficient in the face of flexible and changeable attack methods and lack sufficient adaptability. Second, current security protection measures are mostly focused on preventing external attacks, ignoring device-level security, especially the vulnerability of IoT devices and their complex interactions with cloud platforms and data centers, which reduce the overall security of the system. Traditional protection technologies cannot effectively respond to new attack methods and the rapidly developing digital power grid environment. A more innovative and efficient network security device management method is urgently needed to improve the network security attack and defense capabilities of digital power grids. Summary of the invention
[0004] In view of the above-mentioned problems, the present invention is proposed.
[0005] Therefore, the problem to be solved by the present invention is how to provide a network security device management method based on a generative large model and an intelligent plug-in, aiming to improve the management efficiency of network security devices and the problem of weak collaborative defense capabilities through intelligent means.
[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:
[0007] In the first aspect, an embodiment of the present invention provides a network security device management method based on a generative big model and an intelligent plug-in, which includes fusing a general knowledge base, a network security knowledge base, and power network security attack and defense data to construct a power network security analysis big model base; acquiring the network security data of the power system and preprocessing it to obtain a training data set and importing it into the power network security analysis big model base to obtain a network security analysis model; developing an intelligent plug-in mechanism based on the plug-in interface specification, connecting the network security analysis model and the security device through the intelligent plug-in mechanism to perform coordinated linkage disposal; deploying the network security analysis model and the intelligent plug-in mechanism at the Internet exit, constructing a network security auxiliary analysis and decision-making system, and realizing intelligent analysis and efficient disposal of external attacks.
[0008] As a preferred solution of the network security device management method based on a generative big model and an intelligent plug-in type described in the present invention, wherein: the construction of a large model base for power network security analysis includes the following steps: establishing a knowledge fusion model, the knowledge fusion model includes a general knowledge component, a network security knowledge component and a power network security attack and defense data component; selecting a generative big model architecture as the basic framework, the generative big model architecture is a GPT architecture or a BERT architecture; importing the knowledge fusion model into the basic framework to construct a large model base M for power network security analysis.
[0009] As a preferred solution of the network security device management method based on a generative large model and an intelligent plug-in type described in the present invention, wherein: the network security data includes network attack case data, defense strategy data and security log data; the obtaining of the network security data of the power system and preprocessing to obtain a training data set refers to obtaining the network security data of the power system and cleaning, classifying and labeling it to construct a training data set; the obtaining of the network security analysis model includes the following steps: classifying the network security data according to attack type, attack source and attack target; adding classification identification to the classified network security data to generate labeled data; importing the labeled data into the power network security analysis large model base and performing model training to obtain a network security analysis model.
[0010] As a preferred solution of the network security device management method based on generative big model and intelligent plug-in described in the present invention, wherein: the intelligent plug-in mechanism includes plug-in interface definition and plug-in development and testing; the plug-in interface definition refers to defining the interface specification of the intelligent plug-in according to the communication protocol and data format of the network security device; the plug-in development and testing refers to developing an intelligent plug-in based on the interface specification of the intelligent plug-in.
[0011] As a preferred solution of the network security device management method based on generative large model and intelligent plug-in described in the present invention, wherein: the security device includes a firewall, an intrusion prevention system IPS, a Web application firewall WAF and a honeypot.
[0012] As a preferred solution of the network security device management method based on generative big model and intelligent plug-in described in the present invention, wherein: the collaborative linkage disposal includes feature extraction and selection and association algorithm design; the feature extraction and selection refers to extracting key features from network security data, including attack type, attack source and attack target; the association algorithm design refers to designing an association algorithm based on the generative big model, and using the reasoning ability of the model to perform association analysis on the extracted features.
[0013] As a preferred solution of the network security device management method based on the generative big model and intelligent plug-in type described in the present invention, wherein: the collaborative linkage disposal also includes the design of the attack and defense confrontation analysis framework and the generation and automatic disposal of blocking strategies; the design of the attack and defense confrontation analysis framework refers to the design of the attack and defense confrontation analysis framework based on the results of intelligent correlation analysis; the blocking strategy generation and automatic disposal refers to the use of the thinking chain ability of the generative big model to intelligently generate blocking strategies.
[0014] In the second aspect, in order to further solve the security problems existing in network security, the present invention provides a network security equipment management system based on a generative large model and an intelligent plug-in type in an embodiment, which includes: a model construction module, which is used to integrate the general knowledge base, the network security knowledge base and the power network attack and defense data to build a large model base for power network security analysis; a model training module, which is used to obtain the network security data of the power system and pre-process it to obtain a training data set, and use the training data set to train the large model base for power network security analysis to obtain a network security analysis model; a collaborative linkage module, which is used to develop an intelligent plug-in mechanism based on the plug-in interface specification, and use the intelligent plug-in mechanism to connect the network security analysis model with the firewall, intrusion prevention system IPS, Web application firewall WAF and honeypot to achieve collaborative linkage disposal; an analysis and decision module, which is used to deploy the network security analysis model and the intelligent plug-in mechanism at the Internet exit, build a network security auxiliary analysis and decision system, and achieve intelligent analysis and efficient disposal of external attacks.
[0015] In a third aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the network security device management method based on a generative big model and an intelligent plug-in type as described in the first aspect of the present invention is implemented.
[0016] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the network security device management method based on a generative big model and an intelligent plug-in as described in the first aspect of the present invention is implemented.
[0017] Beneficial effects of the present invention: the present invention constructs a large-scale model base for power network security analysis, utilizes the powerful reasoning ability of the generative large-scale model, conducts intelligent correlation analysis on massive network security data, identifies potential threats and attack modes, and significantly improves the efficiency of network security analysis; the designed intelligent plug-in mechanism can communicate efficiently and stably with various network security devices, feedback network environment data to the large-scale model in real time, and execute the management instructions of the large-scale model, so as to realize intelligent linkage and coordinated defense between devices and improve the ability to respond to complex threats; through the combination of the generative large-scale model and the intelligent plug-in mechanism, efficient coordination and linkage of network security devices are realized, the network security protection level of the digital power grid is significantly enhanced, and a new technical path is opened up for network security protection in the power industry; the present invention has strong adaptability and can be flexibly applied to digital power grid systems of different scales and types. At the same time, the design of the intelligent plug-in mechanism enables the large-scale model to be easily integrated into the existing network security architecture, ensuring its operability and practicality; it can improve the company's network security attack and defense confrontation level, enhance the ability to respond to complex network security attacks, and ensure the network security of the large power grid. It has significant economic and social value and is of great significance for promoting the development and application of network security technology in the power industry. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:
[0019] Figure 1 This is an overall flow chart of the network security device management method based on the generative big model and intelligent plug-in in Example 1.
[0020] Figure 2 This is a schematic diagram of the structure of the computer device in Example 3. DETAILED DESCRIPTION
[0021] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.
[0022] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.
[0023] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.
[0024] Example 1
[0025] Reference Figure 1 , which is the first embodiment of the present invention, and provides a network security device management method based on a generative large model and an intelligent plug-in.
[0026] The existing network security device management methods have the following main problems: First, traditional network isolation and boundary protection technologies mainly rely on static policy settings, which are inadequate when faced with flexible and changeable attack methods and lack sufficient adaptability; second, current security protection measures are mostly focused on preventing external attacks and ignore device-level security, especially the vulnerability of IoT devices and their complex interactions with cloud platforms and data centers, which reduce the overall security of the system.
[0027] The present application provides an effective solution to the above-mentioned problems. Next, multiple embodiments will be combined to explain in detail how to implement the network security device management method based on the generative large model and intelligent plug-in.
[0028] Figure 1 The overall flow chart of the network security device management method based on the generative large model and the intelligent plug-in is shown, including:
[0029] S1: Integrate the general knowledge base, network security knowledge base and power network security attack and defense data to build a large model base for power network security analysis.
[0030] Preferably, constructing a large model base for power network security analysis includes the following steps: establishing a knowledge fusion model, the knowledge fusion model includes a general knowledge component, a network security knowledge component and a power network security attack and defense data component.
[0031] The generative large model architecture is selected as the basic framework, and the generative large model architecture is the GPT architecture or the BERT architecture.
[0032] Import the knowledge fusion model into the basic framework and build a large model base M for power network security analysis.
[0033] Specifically, the specific formula for constructing the large model base M for power network security analysis is as follows:
[0034] M=General knowledge+Network security knowledge+Power network security attack and defense data
[0035] Preferably, the present invention integrates multiple knowledge models. Compared with the existing technology which often relies on security knowledge in a single field, the complexity of the power network requires cross-domain and cross-disciplinary analysis. Therefore, the comprehensive ability of the model is improved through the integration of multiple knowledge components, which solves the problem of cross-domain knowledge integration in power network security analysis, making it more capable of dealing with various complex and changeable security threats in the power network.
[0036] S2: Obtain and preprocess the network security data of the power system to obtain a training data set and import it into the power network security analysis large model base to obtain a network security analysis model.
[0037] Preferably, the network security data includes network attack case data, defense strategy data and security log data, wherein relevant data in the field of network security can be collected from multiple channels.
[0038] Specifically, obtaining the network security data of the power system and preprocessing it to obtain a training data set means obtaining the network security data of the power system and cleaning, classifying and labeling it to construct a high-quality training data set.
[0039] Furthermore, the specific formula for preprocessing is as follows:
[0040] Dpre=Preprocess(Draw)
[0041] Among them, Dpre is the preprocessed network security data; Preprocess is a data preprocessing function that accepts the original network security data Draw and outputs the preprocessed network security data Dpre; Draw is the original network security data.
[0042] Specifically, the specific formula for obtaining the network security data of the power system and performing preprocessing D is as follows:
[0043] D=Efficient collection + data cleaning + classification and labeling
[0044] Furthermore, obtaining the network security analysis model includes the following steps: classifying the network security data according to attack type, attack source and attack target.
[0045] Add classification labels to the classified network security data to generate labeled data.
[0046] The labeled data is imported into the large model base for power network security analysis and model training is performed to obtain a network security analysis model. Through continuous iteration and optimization, the model can accurately understand the professional terminology and attack and defense mechanisms in the field of network security, adapt to the characteristics of the power network security field, and enhance the intelligent correlation analysis capabilities of massive network security data.
[0047] Further, the model training is carried out to obtain the specific formula of the network security analysis model as follows:
[0048] θ(N)=argθmini=∑NL(M(Dpre(i);θ),Y(i))
[0049] Among them, θ(N) is the model parameter obtained after N iterations; L is the loss function, which is used to measure the gap between the model output and the true label; M(Dpre(i); θ) is the output of the model M under the input preprocessed data Dpre(i) and parameter θ; Y(i) is the true label or target output corresponding to the preprocessed data Dpre(i).
[0050] Specifically, the specific formula for model training T is as follows:
[0051] T = General large model foundation + pre-training strategy + fine-tuning optimization
[0052] Preferably, the present invention not only optimizes the quality of training data by performing cleaning, classification and labeling, but also helps the model to more accurately grasp the attack type, attack source and attack target information during the learning stage through precise labeling. Compared with traditional data processing methods, it can more meticulously reflect the security characteristics of the power network and effectively avoid the risk of overfitting.
[0053] S3: Develop an intelligent plug-in mechanism based on the plug-in interface specification, connect the network security analysis model and security equipment through the intelligent plug-in mechanism, and perform coordinated linkage disposal.
[0054] Preferably, the intelligent plug-in mechanism includes plug-in interface definition and plug-in development and testing. The specific formula of the intelligent plug-in mechanism P is as follows:
[0055] P=plug-in mechanism development + real-time data feedback + management instruction execution
[0056] Specifically, the plug-in interface definition refers to defining the interface specification of the smart plug-in according to the communication protocol and data format of the network security device.
[0057] Specifically, plug-in development and testing refers to developing smart plug-ins based on the interface specifications of smart plug-ins, ensuring real-time feedback of network environment data to the network security analysis model, and executing the management instructions of the network security analysis model.
[0058] It should be noted that in the process of developing the smart plug-in mechanism, it is ensured that the smart plug-in mechanism can communicate with various types of devices efficiently and stably, and attention is paid to the stability, security and performance optimization of the smart plug-in mechanism. After the development is completed, strict testing is carried out to ensure that the smart plug-in mechanism can work normally and meet security requirements. Through the smart plug-in mechanism and automated disposal technology, rapid response and efficient disposal of network security incidents are achieved, effectively reducing security risks.
[0059] Furthermore, security devices include firewalls, intrusion prevention systems IPS, web application firewalls WAF and honeypots.
[0060] Preferably, the collaborative linkage treatment includes feature extraction and selection and association algorithm design. The specific formula of the collaborative linkage treatment C is as follows:
[0061] C=Security equipment connection + collaborative defense + intelligent attack and defense confrontation
[0062] Specifically, feature extraction and selection refers to extracting key features from network security data, including attack type, attack source, and attack target.
[0063] Specifically, association algorithm design refers to designing an association algorithm based on a generative large model, and using the model's reasoning ability to perform association analysis on the extracted features.
[0064] Furthermore, the association algorithm design includes the following steps: extracting key features from network security data, including attack type, attack source, and attack target. The selection of these features should be based on their importance and relevance to ensure the accuracy of subsequent association analysis.
[0065] The extracted features are encoded so as to be input into the generative large model. The encoding methods include numericalization and vectorization.
[0066] The encoded features are input into the generative large model, and the model's reasoning ability is used to perform association analysis on the features, which involves multiple iterations and optimizations of the model to ensure the accuracy of the association analysis.
[0067] Furthermore, using the reasoning ability of the model to perform association analysis on features includes the following steps: calculating the similarity between different features, which involves distance metrics, including Euclidean distance and cosine similarity, or involves probability metrics, including conditional probability and joint probability.
[0068] Based on the similarity calculation results, the correlation between features is mined, which involves cluster analysis and association rule mining techniques to discover the potential connections and patterns between features.
[0069] Based on the results of correlation analysis, potential threats and attack patterns are identified, and corresponding defense strategies are formulated, including classification of attack types, tracking of attack sources, and protection of attack targets.
[0070] Furthermore, coordinated and joint disposal also includes the design of attack and defense confrontation analysis framework and the generation and automated disposal of blocking strategies.
[0071] Specifically, the design of the attack and defense adversarial analysis framework refers to designing an attack and defense adversarial analysis framework based on the results of intelligent correlation analysis. The attack and defense adversarial analysis framework is designed based on the results of intelligent correlation analysis. It aims to monitor changes in the network environment in real time and formulate corresponding defense strategies. It can integrate data from various network security devices and realize accurate identification and rapid response to potential threats through the reasoning ability of generative large models.
[0072] Furthermore, the results based on intelligent correlation analysis refer to the potential threats and attack patterns obtained after in-depth mining and correlation analysis of massive network security data. These results serve as the basis for designing an attack and defense analysis framework, helping to build a defense system that can cope with complex network security threats.
[0073] Specifically, blocking strategy generation and automated disposal refers to using the thinking chain capabilities of the generative big model to intelligently generate accurate and effective blocking strategies based on the real-time monitored network environment and threat situation.
[0074] Furthermore, the blocking strategy includes blocking the attack source, isolating the infected area and launching emergency response plans, aiming to effectively curb the spread and harm of network security incidents.
[0075] Furthermore, the attack and defense confrontation analysis framework can monitor the changes in the network environment in real time and formulate corresponding defense strategies according to the threat situation, including the following steps: based on the results of intelligent correlation analysis and the real-time monitoring data of the attack and defense confrontation analysis framework, analyze the type, intensity and propagation path information of the threat.
[0076] Combining the reasoning ability of generative large models and the knowledge base in the field of network security, we formulate highly targeted and effective defense strategies, including firewall rule adjustment, IPS intrusion defense strategy update and WAF Web application firewall strategy optimization, aiming to achieve precise strikes and effective containment of network security threats and improve the overall network security protection level.
[0077] Through the intelligent plug-in mechanism, defense strategies are converted into automated or guided blocking operations, enabling rapid response and efficient handling of network security incidents.
[0078] Conduct real-time evaluation and adjustment of the effectiveness of blocking operations.
[0079] Specifically, real-time evaluation and adjustment include the following steps: collecting the operation data of network security devices and the execution effect of blocking strategies in real time through the intelligent plug-in mechanism, and using the generative big model to conduct real-time evaluation. The evaluation content includes the effectiveness of the blocking strategy, the reduction rate of network security incidents and the stability of system performance.
[0080] Based on the results of real-time assessments and changes in the network security environment, timely adjustments and optimizations are made to blocking strategies. Adjustment methods include adjusting firewall rules, updating IPS intrusion defense strategies, and optimizing WAF Web application firewall strategies to ensure the effectiveness and accuracy of defense strategies.
[0081] It should be noted that feature extraction and selection can be based on the importance and relevance of features, providing a basis for subsequent association analysis. Association algorithm design can calculate the similarity and correlation between features, discover potential threats and attack patterns, and provide more accurate defense strategies for network security.
[0082] Preferably, the present invention ensures seamless connection between network security analysis models and devices by utilizing the interface specifications of the plug-in. This mechanism can greatly improve the response speed and avoid the difficulty of real-time response caused by system incompatibility or data transmission delay in traditional methods, thereby effectively reducing the potential losses of security incidents.
[0083] S4: Deploy the network security analysis model and intelligent plug-in mechanism at the Internet exit, build a network security auxiliary analysis and decision-making system, and realize intelligent analysis and efficient disposal of external attacks.
[0084] Preferably, building a network security auxiliary analysis and decision system includes the following steps: based on the extracted key features, namely attack type, attack source and attack target, using a network security analysis model to calculate the similarity and correlation between key features, and generate feature correlation results.
[0085] An attack and defense analysis framework is constructed according to the feature correlation results, and a defense strategy is generated based on the attack and defense analysis framework.
[0086] The defense strategy is converted into blocking operation instructions for network security devices through the intelligent plug-in mechanism.
[0087] Monitor the real-time environmental data after the blocking operation instructions are executed, adjust the defense strategy, and realize intelligent analysis and efficient disposal of external attacks.
[0088] Furthermore, the specific formula of the network security auxiliary analysis and decision system A is as follows:
[0089] A=Demonstration application system+intelligent analysis+efficient disposal
[0090] Specifically, the specific formula for network security device management text is as follows:
[0091] textNetwork security intelligent management=(M)+(D)+(T)+(P)+(C)+(A)
[0092] Preferably, the present invention can intelligently generate and adjust network security defense strategies in real time through the attack and defense analysis framework based on feature association and the reasoning ability of the generative large model. Compared with traditional static strategies, it is more flexible and can respond to different types of attacks in real time, so that the system has stronger adaptability and intelligent defense capabilities; through real-time monitoring and strategy adjustment, it can significantly reduce the risk of system attacks and reduce the need for human intervention.
[0093] In summary, the present invention constructs a large-scale model base for power network security analysis, utilizes the powerful reasoning ability of the generative large model, conducts intelligent correlation analysis on massive network security data, identifies potential threats and attack modes, and significantly improves the efficiency of network security analysis; the designed intelligent plug-in mechanism can communicate efficiently and stably with various network security devices, feedback network environment data to the large model in real time, and execute the management instructions of the large model, so as to realize intelligent linkage and collaborative defense between devices and improve the ability to respond to complex threats; through the combination of the generative large model and the intelligent plug-in mechanism, efficient coordination and linkage of network security devices are realized, the network security protection level of the digital power grid is significantly enhanced, and a new technical path is opened up for network security protection in the power industry; the present invention has strong adaptability and can be flexibly applied to digital power grid systems of different scales and types. At the same time, the design of the intelligent plug-in mechanism enables the large model to be easily integrated into the existing network security architecture, ensuring its operability and practicality; it can improve the company's network security attack and defense confrontation level, enhance the ability to respond to complex network security attacks, and ensure the network security of the large power grid. It has significant economic and social value and is of great significance to promoting the development and application of network security technology in the power industry.
[0094] Embodiment 2 is an embodiment of the present invention, which provides a network security equipment management system based on a generative large model and an intelligent plug-in, including: a model construction module, which is used to integrate a general knowledge base, a network security knowledge base and a power network security attack and defense data to build a large model base for power network security analysis; a model training module, which is used to obtain and pre-process the network security data of the power system to obtain a training data set, and use the training data set to train the large model base for power network security analysis to obtain a network security analysis model; a collaborative linkage module, which is used to develop an intelligent plug-in mechanism based on the plug-in interface specification, and use the intelligent plug-in mechanism to connect the network security analysis model with a firewall, an intrusion prevention system IPS, a Web application firewall WAF and a honeypot to achieve collaborative linkage disposal; an analysis and decision module, which is used to deploy the network security analysis model and the intelligent plug-in mechanism at the Internet exit, build a network security auxiliary analysis and decision system, and achieve intelligent analysis and efficient disposal of external attacks.
[0095] Embodiment 3 is an embodiment of the present invention, which is different from the previous embodiment in that:
[0096] like Figure 2 As shown, if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.
[0097] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.
[0098] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.
[0099] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0100] Example 4 is an embodiment of the present invention, which provides a network security device management method based on a generative large model and an intelligent plug-in. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through simulation experiments.
[0101] This example simulates a network security device management environment, in which the amount of original data collected in the data collection and preprocessing stage is 10 million, and the amount retained after data cleaning is 9.5 million. The accuracy of data classification and labeling is 98%, and the accuracy of classification and labeling is ensured through manual review. Table 1 shows the comparison of data before and after data cleaning and classification and labeling accuracy.
[0102] Table 1 Comparison of data before and after cleaning and classification labeling accuracy
[0103] Data Types Collection volume After cleaning Labeling accuracy Cyber attack cases 3 million 2.9 million 98.5％ Defensive Strategy 2 million 1.95 million 99％ Security Log 5 million 4.65 million 96％
[0104] In the model training and optimization stage, the selected model architecture is GPT-3, the training rounds are 10 rounds, the model accuracy reaches 95% on the test set, and the loss function value finally converges to below 0.05. The specific training data is shown in Table 2.
[0105] Table 2 Model training data table
[0106] Training rounds Loss function value Accuracy 1 0.25 85％ 3 0.15 90％ 5 0.10 93％ 10 0.05 95％
[0107] It can be seen from the above table that the present invention constructs a large model base for power network security analysis, utilizes the powerful reasoning ability of the generative large model, conducts intelligent correlation analysis on massive network security data, and realizes intelligent analysis and efficient disposal of external attacks.
[0108] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.
Claims
1. A network security device management method based on a generative large model and an intelligent plug-in, characterized in that: include: Integrate the general knowledge base, network security knowledge base and power network security attack and defense data to build a large model base for power network security analysis; Acquire and preprocess the network security data of the power system to obtain a training data set and import it into the power network security analysis large model base to obtain a network security analysis model; Developing an intelligent plug-in mechanism based on the plug-in interface specification, connecting the network security analysis model and the security device through the intelligent plug-in mechanism to perform coordinated linkage disposal; The network security analysis model and the intelligent plug-in mechanism are deployed at the Internet exit to build a network security auxiliary analysis and decision-making system to achieve intelligent analysis and efficient disposal of external attacks.
2. The network security device management method based on a generative large model and an intelligent plug-in as claimed in claim 1, characterized in that: The construction of the large model base for power network security analysis includes the following steps: Establishing a knowledge fusion model, wherein the knowledge fusion model includes a general knowledge component, a network security knowledge component, and a power network security attack and defense data component; A generative large model architecture is selected as a basic framework, wherein the generative large model architecture is a GPT architecture or a BERT architecture; The knowledge fusion model is imported into the basic framework to construct a large model base M for power network security analysis.
3. The network security device management method based on the generative large model and intelligent plug-in type as claimed in claim 2, characterized in that: The network security data includes network attack case data, defense strategy data and security log data; Acquiring the network security data of the power system and preprocessing it to obtain a training data set means acquiring the network security data of the power system and cleaning, classifying and labeling it to construct a training data set; The obtaining of the network security analysis model comprises the following steps: Classifying the network security data according to attack type, attack source and attack target; Adding classification identifiers to the classified network security data to generate labeled data; The annotated data is imported into the large model base for power network security analysis and model training is performed to obtain a network security analysis model.
4. The network security device management method based on the generative large model and intelligent plug-in type as claimed in claim 3, characterized in that: The smart plug-in mechanism includes plug-in interface definition and plug-in development and testing; The plug-in interface definition refers to defining the interface specification of the smart plug-in according to the communication protocol and data format of the network security device; The plug-in development and testing refers to developing a smart plug-in based on the interface specification of the smart plug-in.
5. The network security device management method based on the generative large model and intelligent plug-in type as claimed in claim 4, characterized in that: The security devices include firewalls, intrusion prevention systems IPS, Web application firewalls WAF and honeypots.
6. The network security device management method based on generative large model and intelligent plug-in as claimed in claim 5, characterized in that: The collaborative linkage treatment includes feature extraction and selection and association algorithm design; The feature extraction and selection refers to extracting key features from network security data, including attack type, attack source and attack target; The association algorithm design refers to designing an association algorithm based on a generative large model, and utilizing the reasoning ability of the model to perform association analysis on the extracted features.
7. The network security device management method based on generative large model and intelligent plug-in type as claimed in claim 6, characterized in that: The coordinated linkage disposal also includes attack and defense confrontation analysis framework design and blocking strategy generation and automated disposal; The attack and defense confrontation analysis framework design refers to designing an attack and defense confrontation analysis framework based on the results of intelligent association analysis; The blocking strategy generation and automated handling refers to utilizing the thinking chain capability of the generative big model to intelligently generate blocking strategies.
8. A network security device management system based on a generative large model and an intelligent plug-in, based on a network security device management method based on a generative large model and an intelligent plug-in according to any one of claims 1 to 7, characterized in that: include, Model building module, used to integrate the general knowledge base, network security knowledge base and power network security attack and defense data to build a large model base for power network security analysis; The model training module is used to obtain and pre-process the network security data of the power system to obtain a training data set, and use the training data set to train the large model base for power network security analysis to obtain a network security analysis model; The collaborative linkage module is used to develop an intelligent plug-in mechanism based on the plug-in interface specification, and use the intelligent plug-in mechanism to connect the network security analysis model with the firewall, intrusion prevention system IPS, Web application firewall WAF and honeypot to achieve collaborative linkage disposal; The analysis and decision-making module is used to deploy the network security analysis model and the intelligent plug-in mechanism at the Internet exit, build a network security auxiliary analysis and decision-making system, and realize intelligent analysis and efficient disposal of external attacks.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security device management method based on the generative large model and intelligent plug-in type described in any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security device management method based on a generative large model and an intelligent plug-in type as described in any one of claims 1 to 7 are implemented.