Network security threat intelligent identification method based on generative large model

Abstract

The invention provides a network security threat intelligent identification method based on a generative large model, and belongs to the technical field of network security. Comprising the steps of obtaining system demand information, and determining a threat identification target and a system coverage range; collecting network system data, wherein the network system data comprises equipment log information, network flow information and terminal behavior information; preprocessing the network system data to obtain standardized data; selecting and training a machine learning model based on the standardized data to obtain a threat identification model; network behaviors are analyzed, abnormal behaviors are identified, and threat classification is carried out; executing corresponding safety protection measures according to the threat classification result; performing manual auditing on the abnormal behavior, and formulating a protection strategy in a targeted manner; and periodically evaluating the system operation state to generate a safety report. According to the invention, automatic response type intelligent identification of network security threats is realized, and the threats can be effectively detected under the condition of attack escape detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security threat intelligent identification method based on a generative large model. Background Art

[0002] With the popularization and development of computer networks, our lives and work are increasingly dependent on the network. The forms of network security threats are also showing a trend of diversification, including DDoS attacks, malware propagation, internal threats, etc. At present, the mainstream network security protection technologies mainly include intrusion detection based on feature matching, anomaly identification based on behavior analysis, and threat warning based on rule engines. These technologies monitor and analyze network traffic, system logs, and user behaviors to identify and protect against potential threats.

[0003] However, there are still many problems with existing network security threat identification methods. First, traditional feature matching methods are difficult to deal with zero-day attacks and variant threats; second, rule-based detection mechanisms lack adaptive capabilities and cannot respond to new attack methods in a timely manner; third, existing behavioral analysis methods often have missed reports and false positives when facing complex attack chains; finally, with the continuous evolution of attack technology, attackers increasingly use various adversarial technologies to evade detection, making threat identification more challenging. These problems make it difficult for network security protection to meet actual needs, and there is an urgent need to develop new intelligent threat identification methods. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the present invention provides a method for intelligently identifying network security threats based on a generative large model, which can solve the problems mentioned in the background technology.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a network security threat intelligent identification method based on a generative large model, comprising: obtaining system requirement information, determining threat identification targets and system coverage;

[0007] Collecting network system data, including device log information, network traffic information, and terminal behavior information;

[0008] Preprocessing the network system data to obtain standardized data;

[0009] Select and train a machine learning model based on the standardized data to obtain a threat identification model;

[0010] Analyze network behaviors using the threat identification model, identify abnormal behaviors and classify threats;

[0011] Execute corresponding security protection measures according to the threat classification results;

[0012] Manually review the abnormal behaviors and formulate targeted protection strategies;

[0013] Conduct periodic assessments of system operating status and generate security reports.

[0014] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the system requirement information includes defining the goal, defining the scope and compliance considerations, clarifying the problems that the system needs to solve, and clarifying the coverage area and data services of the system under the premise of legality and compliance;

[0015] The definition of the target refers to clarifying DDoS attacks, malware propagation, and internal threats, and determining the targets to be identified;

[0016] The scope of the definition is to list all critical IT assets, including servers, databases, network equipment and terminal devices, to provide for the identification of security threats.

[0017] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, wherein: the device log information is obtained from various IT resources, and the device log includes operation records of the system, network equipment and application programs;

[0018] The data preprocessing includes cleaning, normalization and feature extraction; wherein cleaning is to delete data entries that are completely identical or highly similar, select deletion for data containing missing values, use interpolation methods to fill in missing values, identify and correct data entry errors, including outliers and format errors, and ensure that the data format of the same field is consistent.

[0019] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, wherein: selecting and training a machine learning model based on the standardized data to obtain a threat identification model means using classification, regression and clustering to select a suitable algorithm, considering the scale, dimension and sparsity of the data to select the algorithm, model training is to divide the data set into a training set, a validation set and a test set, initialize the model according to the selected algorithm, set the initial parameters, parameter tuning is to exhaust all possible hyperparameter combinations, select the combination with the best performance, randomly select hyperparameter combinations, and usually find better parameters faster than grid search.

[0020] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the threat identification model analyzes the network behavior including:

[0021] Acquire real-time network behavior data, and compare the real-time network behavior data with a baseline model;

[0022] If a sudden increase in traffic and an abnormal number of connections are detected, it will be marked as a potential DDoS attack;

[0023] If suspicious file operations are detected and there are abnormal network connections, they will be marked as potential malware;

[0024] If sensitive data access is detected and the operation time is abnormal, it will be marked as a potential insider threat.

[0025] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the security protection measures include:

[0026] For DDoS attacks, analyze attack traffic characteristics, create a source IP blacklist, and simultaneously deploy traffic cleaning rules;

[0027] For malware, extract malicious code features, build a file fingerprint library, and deploy terminal detection and killing strategies;

[0028] For internal threats, record user behavior trajectories, establish behavior baselines, and enforce access control policies;

[0029] If multiple threats occur at the same time, they will be handled in the order of DDoS attack, malware, and internal threat.

[0030] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the manual review includes:

[0031] Extract characteristic information of abnormal behavior, including timestamp, source IP, target IP, behavior type and impact range;

[0032] If a new attack method is discovered, the attack chain will be analyzed and the protection strategy will be updated;

[0033] If it is confirmed to be a false positive, the relevant features will be added to the whitelist;

[0034] The threat signature database is dynamically updated based on the audit results.

[0035] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the periodic evaluation includes:

[0036] Collecting system protection data, including interception records, alarm logs and disposal results;

[0037] If the protection strategy fails, the emergency response mechanism will be activated;

[0038] If conflicts in protection rules are found, optimize and adjust the rules;

[0039] Adjust system protection strategies based on the assessment results.

[0040] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the security report generation includes:

[0041] Summarize the distribution of threat events and analyze the evolution trend of attack characteristics;

[0042] If a new attack link appears, build an attack scenario library;

[0043] If the protection effect is found to be reduced, a strategy optimization suggestion will be generated;

[0044] Update the protection system based on threat tracing results.

[0045] As a preferred solution of the network security threat intelligent identification method based on the generative large model described in the present invention, the model update includes:

[0046] Collect confirmed threat samples and false positive samples to build a training set;

[0047] If new attack features appear, feature engineering optimization is performed;

[0048] If the model detection capability decreases, fine-tune the parameters;

[0049] Deploy the updated model after verification in the sandbox environment.

[0050] The beneficial effects of the present invention are as follows: the present invention first sets the identification target, defines the identification scope, completes log collection in advance, monitors network traffic, analyzes terminal behavior, cleans the data and extracts necessary features, establishes or selects a suitable machine learning algorithm according to needs, analyzes the data and optimizes parameters, thereby realizing the classification of abnormal pattern behaviors and threats, and finally realizing automatic response to security risks, and sending alarms to relevant personnel, realizing automatic responsive intelligent identification of network security threats, and can effectively detect threats when attacks evade detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0052] Figure 1 This is a schematic diagram of the overall process of a network security threat intelligent identification method based on a generative large model proposed in the present invention. DETAILED DESCRIPTION

[0053] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0054] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0055] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a method for intelligent identification of network security threats based on a generative large model.

[0056] S1: Requirements definition and planning, including defining goals, defining scope and compliance considerations, clarifying the problems that the system needs to solve, and clarifying the system's coverage area and data services under the premise of legality and compliance;

[0057] S2: Data collection, including log collection, network traffic monitoring, and terminal behavior monitoring, using network tools to collect logs from various network devices and applications;

[0058] S3: Data preprocessing, through cleaning, normalization and feature extraction, real-time data processing for subsequent analysis;

[0059] S4: Model selection and training: select the appropriate machine learning algorithm according to the needs through algorithm selection, use the labeled data set to train the model so that it can distinguish normal behavior from abnormal behavior, optimize the model parameters through cross-validation method, achieve parameter tuning and improve accuracy;

[0060] S5: Anomaly detection and threat classification, identifying behaviors that do not conform to normal patterns and classifying detected abnormal behaviors;

[0061] S6: Automated response: Set response strategies for different types of threats, such as blocking malicious traffic, isolating affected devices, etc., automatically execute corresponding security measures based on the results of threat classification, and send alerts to relevant personnel for further manual review;

[0062] S7: Manual review and intervention: Conduct in-depth analysis of complex threat situations. When necessary, reverse engineering-related technologies should be used to develop special countermeasures for particularly serious threats.

[0063] S8: Audit and Report: Regularly audit the entire threat identification system to ensure its effective operation, generate regular security reports, and summarize threat trends, detection results, and the effectiveness of response measures.

[0064] In the above specific implementation, the definition goal in step 1 is to clearly identify the problems that the system needs to solve, including DDoS attacks, malware propagation and internal threats. For DDoS attacks, network traffic monitoring tools are used to continuously monitor incoming and outgoing network traffic, analyze normal traffic patterns, establish traffic baselines, and identify traffic anomalies by comparing with the baselines, such as sudden large numbers of requests and unusual traffic patterns. The characteristics of abnormal traffic, source IP addresses, request types and request frequencies are analyzed. Machine learning models are used to identify known DDoS attack patterns. Once an attack is detected, an automatic response mechanism is immediately triggered, using traffic cleaning and IP blacklists, generating detailed attack reports, and conducting post-analysis to improve defense strategies.

[0065] To prevent malware from spreading, we monitor file downloads, executions, and system behavior changes, use antivirus engines for signature matching and heuristic analysis, run suspicious files in an isolated environment, observe their behavior, monitor network communications, find connections to known malicious servers, train models to identify malware features and behavior patterns, and take immediate action once malware is detected, such as isolating files and terminating processes. We use external threat intelligence to update malware databases and raise users' awareness of phishing emails and other social engineering attacks.

[0066] Internal threats are detected by collecting and analyzing user behavior data, establishing a normal behavior model, identifying abnormal behavior by comparing it with the normal behavior model, implementing strict access control policies, ensuring that users can only access the resources they need, regularly auditing system logs, looking for abnormal login attempts, permission changes, etc., monitoring access to and transmission of sensitive data, preventing data leakage, regularly conducting security awareness training for employees, emphasizing the risks of internal threats, and developing emergency response plans so that quick action can be taken when internal threats are detected.

[0067] In the above specific implementation, the scope defined in step 1 is to list all key IT assets, including servers, databases, network devices and terminal devices, create a detailed network topology diagram to show the connection between various network areas, including internal networks, DMZs, and external networks, determine the boundaries of each network area and how they are connected to each other, which includes firewall rules, router configurations and VLANs, and conduct a risk assessment on each network area to determine which areas are most likely to become targets of attack.

[0068] In the above specific implementation, log collection in step 2 is the process of obtaining operation logs from various IT resources. These logs contain operation records of systems, network devices, and applications, which can help security teams identify abnormal behaviors and potential threats;

[0069] Network traffic monitoring is to monitor data transmission in the network in real time and identify abnormal traffic patterns, including DDoS attacks and data leaks;

[0070] Endpoint Behavior Monitoring Endpoint behavior monitoring is designed to track and record end-user behavior, including logins, file access, and program execution, to detect potential insider threats and malicious activity.

[0071] In the above specific implementation, the cleaning in step 3 is to remove noise and irrelevant information in the data, ensure data quality, improve the accuracy of analysis, delete completely identical or highly similar data entries, and for data containing missing values, the entry can be selected to be deleted, and the interpolation method can be used to fill the missing values, identify and correct data entry errors, including outliers and format errors, ensure that the data format of the same field is consistent, including date format and IP address format, remove data that is useless for analysis, and reduce noise;

[0072] Normalization is the process of converting data into a unified format so that data from different sources can be used together and correctly processed by machine learning models.

[0073] Feature extraction is the process of extracting key features from raw data that help the model identify threats and improve the model's predictive and generalization capabilities.

[0074] In the above specific implementation, the algorithm selection in step 4 is to select a suitable algorithm based on the type of problem you want to solve, using classification, regression and clustering, taking into account factors such as the scale, dimension and sparsity of the data. In some scenarios, the interpretability of the model is very important, especially when the results need to be explained to non-technical personnel. The algorithm is selected based on the available computing resources, including GPU, memory and storage;

[0075] Model training is to divide the data set into training set, validation set and test set, initialize the model according to the selected algorithm, set the initial parameters, feed the input data into the model, calculate the output, calculate the loss function including cross entropy loss and mean square error according to the model output and the true label, calculate the gradient according to the loss function, and back-propagate to update the model parameters, repeat the forward propagation and back-propagation process until the stopping condition is met;

[0076] Parameter tuning is to exhaustively enumerate all possible hyperparameter combinations and select the combination with the best performance. Randomly selecting hyperparameter combinations usually finds better parameters faster than grid search. The optimization method based on Bayesian theory can find better parameter combinations in a smaller number of trials, simulating the natural evolution process, and finding the optimal solution through selection, crossover and mutation. For some continuous hyperparameters, gradient-based methods can be used for optimization.

[0077] In the above specific implementation, in step 5, the purpose of anomaly detection is to identify activities that are significantly different from normal network behavior or user behavior, which may be potential security threats, collect and preprocess data, including cleaning, normalization and feature extraction, establish a baseline model of normal behavior based on historical data, use one of the above methods or a combination of multiple methods to detect anomalies, set a reasonable threshold to determine whether a behavior is abnormal, apply anomaly detection models in real-time data streams, and continuously monitor network activities;

[0078] Threat classification is to manually label abnormal behaviors in historical data, indicate specific threat types, select features that help distinguish different threat types, use labeled data to train classification models, use validation sets to evaluate model performance, including accuracy, recall, and F1 scores, adjust model parameters based on model evaluation results, optimize model performance, input detected anomalies into the trained model to obtain specific threat types, and continuously adjust the model based on performance in actual applications to improve classification accuracy.

[0079] In the above specific implementation, the automated response in step 6 needs to define different response strategies according to the type and severity of the threat. For DDoS attacks, malware infections and internal threats, the response strategies may be different, and different levels of response measures are defined, including warnings, isolation, and blocking. The response level is determined according to the urgency and potential impact of the threat. When the malware detection engine reports that a host is infected with malware, a response action is generated: immediately send an alert to the security team, isolate the infected host from the network, record the infection details, including infection time, infection path, etc., collect relevant logs and files for further analysis, try to automatically remove the malware, and restore the system to a clean state, notify the affected users, and provide the next step of the operation guide.

[0080] In the above specific implementation method, the manual review and intervention in step 7, when the automated system detects that a server may be infected with malware, the auditor receives an alert, checks the information provided by the automated system, including the threat score, relevant logs and preliminary evidence, checks the server's log files, looks for abnormal login attempts, abnormal processes and file modifications, analyzes the server's network traffic, looks for communications with known malicious IP addresses or domain names, and if necessary, performs digital forensics to collect more evidence. Based on the analysis results, the auditor assesses the actual risk of the malware to the server and the entire network, decides whether it is necessary to isolate the server, clean up the malware, notify the IT department and management, record the audit process and decisions in detail, generate an audit report, and archive it, notify the relevant departments of the audit results, and discuss the follow-up action plan with management.

[0081] In the above specific implementation method, the audit and report in step 8 is to ensure the effectiveness and compliance of security policies, procedures and control measures, discover potential security vulnerabilities, and put forward improvement suggestions, clarify the audit object, time frame and objectives, list the specific projects, methods and tools that need to be reviewed, determine the audit team members, including internal and external auditors, notify the audited departments in advance so that they can prepare, collect evidence through interviews, questionnaires, document reviews and log analysis, conduct on-site inspections of physical security, server rooms and workstations, use vulnerability scanning tools and penetration testing methods to conduct technical assessments, compare security policies and standards, analyze the collected evidence, write audit reports, and Describe the audit process, issues found, risk assessment and improvement suggestions in detail, rate the risks of the issues found, distinguish between high, medium and low risks, provide specific improvement suggestions, including short-term and long-term action plans, cooperate with the audited department to develop a detailed rectification plan, including responsible persons, completion time and expected results, track the rectification progress regularly to ensure that the rectification measures are effectively implemented, and re-evaluate after the rectification is completed to confirm that the problem has been resolved, collect relevant data from various security tools and systems, including SIEM logs, vulnerability scanning reports and intrusion detection system logs, analyze the collected data, identify trends, patterns and anomalies, and write reports according to established report templates.

[0082] Technical advantages: 1. Easy to understand: Rules are usually based on expert knowledge and experience, easy to understand and explain. 2. Flexibility: Different rules can be defined according to specific needs and scenarios. 3. Customizability: Rules can be customized according to specific performance standards to meet different evaluation needs.

[0083] In summary, the present invention obtains a network security threat intelligent identification method based on a generative large model through the above design. First, the identification target is set, the identification scope is defined, log collection is completed in advance, network traffic is monitored, terminal behavior is analyzed, and then the data is cleaned and necessary features are extracted. According to the needs, a suitable machine learning algorithm is established or selected, and the data is analyzed and the parameters are optimized, so as to realize the classification of abnormal mode behaviors and threats, and finally realize the automatic response to security risks, and send alarms to relevant personnel, realizing the automatic responsiveness of network security threats. Intelligent identification can effectively detect threats when attacks evade detection.

[0084] Example 2 is an embodiment of the present invention, which provides a network security threat intelligent identification method based on a generative large model. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0085] To verify the effectiveness of the present invention, the present invention has constructed an experimental environment, including 100 terminal devices and 10 servers, to simulate the enterprise network architecture for testing. The experimental data set contains 50,000 normal network behavior samples, 10,000 DDoS attack samples, 8,000 malware samples, and 5,000 internal threat samples. The present invention compares the scheme of the present invention with the traditional rule-matching-based method and machine learning method. During the test, the present invention collects network traffic characteristics, system call sequences and user behavior data by deploying network probes, log collectors and terminal agents. In order to evaluate the robustness of the scheme, the present invention also introduces adversarial attack samples, including mutant Trojans, obfuscated malicious codes and disguised abnormal behaviors.

[0086] During the three-month test, the present invention conducted a comprehensive performance evaluation of the three solutions. The evaluation indicators include threat detection accuracy, false alarm rate, missed alarm rate, response time and system resource usage. At the same time, the present invention also tested the generalization ability of the model in the face of zero-day attacks, as well as its real-time processing capabilities in high-concurrency scenarios. For newly emerging attack features, the present invention records the adaptive learning process of the model and the dynamic adjustment of the protection strategy. Special attention is paid to the performance of the model in handling complex attack chains, including the recognition accuracy and traceability of multi-stage APT attacks.

[0087] Table 1 Comparison with existing technology

[0088] Test indicators Traditional rule matching method Machine Learning Methods The present invention Threat Detection Accuracy 82.5％ 88.7％ 94.3％ False Positive Rate 15.8％ 8.9％ 4.2％ False negative rate 12.3％ 7.6％ 3.5％ Average response time (ms) 850 420 180 CPU usage 45％ 65％ 35％ Memory usage (GB) 4.2 6.8 3.5 Zero-day attack detection rate 35.6％ 68.4％ 85.7％ Complex attack chain recognition rate 42.3％ 75.6％ 89.2％ Adaptive learning efficiency 0％ 65.8％ 92.4％ System throughput (Gbps) 2.5 1.8 3.2

[0089] Through the analysis of experimental data, it can be concluded that the present invention is significantly superior to traditional methods in all key indicators. In terms of threat detection accuracy, the present invention reaches 94.3%, which is 11.8 percentage points higher than the traditional rule matching method and 5.6 percentage points higher than the machine learning method; in terms of false alarm rate and missed alarm rate, the present invention is reduced to 4.2% and 3.5% respectively, which is much better than the other two schemes; in terms of performance, the average response time of the present invention is only 180ms, which is 1 / 4 of the traditional method, and the resource occupancy is lower, the CPU occupancy rate is only 35%, and the memory occupancy is 3.5GB; in terms of handling new threats, the present invention is particularly outstanding, the zero-day attack detection rate reaches 85.7%, and the complex attack chain recognition rate reaches 89.2%, which is due to the deep learning model and dynamic feature extraction mechanism adopted by the present invention; in terms of scalability, the system throughput of the present invention reaches 3.2Gbps, while maintaining 92.4% of the adaptive learning efficiency, which proves that the present invention has significant technical advantages and practical value in practical application environments. These data fully prove the innovation and practicality of the present invention in the field of intelligent identification of network security threats.

[0090] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security threat intelligent identification method based on a generative large model, characterized in that: include: Obtain system requirement information, determine threat identification targets and system coverage; Collecting network system data, including device log information, network traffic information, and terminal behavior information; Preprocessing the network system data to obtain standardized data; Select and train a machine learning model based on the standardized data to obtain a threat identification model; Analyze network behaviors using the threat identification model, identify abnormal behaviors and classify threats; Execute corresponding security protection measures according to the threat classification results; Manually review the abnormal behaviors and formulate targeted protection strategies; Conduct periodic assessments of system operating status and generate security reports.

2. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 1, characterized in that: The system requirement information includes defining objectives, defining scope and compliance considerations, clarifying the problems that the system needs to solve, and clarifying the system's coverage area and data services on the premise of legality and compliance; The definition of the target refers to clarifying DDoS attacks, malware propagation and internal threats, and determining the targets to be identified; The scope of the definition is to list all critical IT assets, including servers, databases, network equipment and terminal devices, to provide for the identification of security threats.

3. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 2, characterized in that: The device log information is obtained from various IT resources, and the device log includes operation records of systems, network devices and applications; The data preprocessing includes cleaning, normalization and feature extraction; wherein cleaning is to delete data entries that are completely identical or highly similar, select deletion for data containing missing values, use interpolation methods to fill in missing values, identify and correct data entry errors, including outliers and format errors, and ensure that the data format of the same field is consistent.

4. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 3, characterized in that: Selecting and training a machine learning model based on the standardized data to obtain a threat identification model refers to using classification, regression and clustering to select a suitable algorithm, and selecting an algorithm by considering the scale, dimension and sparsity of the data. Model training is to divide the data set into a training set, a validation set and a test set, initialize the model according to the selected algorithm, set the initial parameters, and parameter tuning is to exhaustively enumerate all possible hyperparameter combinations and select the combination with the best performance. Randomly selecting a hyperparameter combination usually finds better parameters faster than grid search.

5. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 4, characterized in that: The threat identification model analyzes network behavior including: Acquire real-time network behavior data, and compare the real-time network behavior data with a baseline model; If a sudden increase in traffic and an abnormal number of connections are detected, it will be marked as a potential DDoS attack; If suspicious file operations are detected and there are abnormal network connections, they will be marked as potential malware; If sensitive data access is detected and the operation time is abnormal, it will be marked as a potential insider threat.

6. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 5, characterized in that: The safety protection measures include: For DDoS attacks, analyze attack traffic characteristics, create a source IP blacklist, and simultaneously deploy traffic cleaning rules; For malware, extract malicious code features, build a file fingerprint library, and deploy terminal detection and killing strategies; For internal threats, record user behavior trajectories, establish behavior baselines, and enforce access control policies; If multiple threats occur at the same time, they will be handled in the order of DDoS attack, malware, and internal threat.

7. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 6, characterized in that: The manual review includes: Extract characteristic information of abnormal behavior, including timestamp, source IP, target IP, behavior type and impact range; If a new attack method is discovered, the attack chain will be analyzed and the protection strategy will be updated; If it is confirmed to be a false positive, the relevant features will be added to the whitelist; The threat signature database is dynamically updated based on the audit results.

8. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 7, characterized in that: The periodic assessments include: Collecting system protection data, including interception records, alarm logs and disposal results; If the protection strategy fails, the emergency response mechanism will be activated; If conflicts in protection rules are found, optimize and adjust the rules; Adjust system protection strategies based on the assessment results.

9. The method for intelligently identifying network security threats based on a generative large model as claimed in claim 8, characterized in that: The safety report generation includes: Summarize the distribution of threat events and analyze the evolution trend of attack characteristics; If a new attack link appears, build an attack scenario library; If the protection effect is found to be reduced, a strategy optimization suggestion will be generated; Update the protection system based on threat tracing results.

10. The network security threat intelligent identification method based on generative large model according to claim 9 is characterized by: The model update includes: Collect confirmed threat samples and false positive samples to build a training set; If new attack features appear, feature engineering optimization is performed; If the model detection capability decreases, fine-tune the parameters; Deploy the updated model after verification in the sandbox environment.

Images