Network security attack coping method based on generative large model

Abstract

The invention discloses a network security attack coping method based on a generative large model, and relates to the technical field of network security, and the method comprises the steps: obtaining metadata: automatically obtaining network security basic knowledge and network security attack technique data, and forming a knowledge base; classifying and labeling the metadata, namely automatically classifying and labeling network security basic knowledge and network security attack technique data; establishing a security model: constructing a network security analysis model, and cleaning malicious data and error data; model training is executed, wherein training and fine tuning are carried out on network security data; and performing evaluation feedback for coping with network security attacks. According to the method, the automation level and efficiency of network security analysis are improved, the manual analysis cost is reduced, the model can adapt to continuously evolved network security threats through continuous learning and optimization, and more intelligent and reliable technical support is provided for network security protection of a power system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security attack response method based on a generative large model. Background Art

[0002] As the complexity and frequency of cyber attacks continue to increase, traditional network security protection methods can no longer cope with the increasingly severe threats, so network security solutions based on large models have gradually received attention and attention. The current problems with power network security are: 1. A large number of manual attacks and defenses are used, which makes it difficult to deal with external automation and platform-based behaviors; 2. The level of on-site security personnel is uneven, and a large number of external experts are relied on for attack and defense. Expert experience is difficult to pass on, and after the project is completed, the experience is lost and cannot be stored in a knowledge base. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the present invention provides a network security attack response method based on a generative large model, which can solve the problems mentioned in the background technology.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: A network security attack response method based on a generative large model, comprising: obtaining metadata, including automatically obtaining basic network security knowledge and network security attack method data to form a knowledge base;

[0006] Classifying and labeling the metadata, including automatically classifying and labeling the basic network security knowledge and network security attack method data;

[0007] Establish security models, including building network security analysis models to clean malicious and erroneous data;

[0008] Performing model training, including training and fine-tuning on the cybersecurity data;

[0009] Conduct evaluation and feedback, including building an evaluation and feedback mechanism for a large network security model to respond to network security attacks.

[0010] As a preferred solution of the network security attack response method based on the generative large model described in the present invention, wherein: the metadata includes general data, power-specific data and security-specific data;

[0011] Using crawling technology to automatically extract public data from the Internet to obtain the general data, power-specific data, and security-specific data;

[0012] By cooperating with professional data providers, legally authorized and strictly screened commercial security data is obtained as the general data, power-specific data and security-specific data.

[0013] As a preferred solution of the network security attack response method based on the generative big model described in the present invention, the automatic classification uses a big model based on the Prompt project to intelligently classify different categories of network security data.

[0014] As a preferred solution of the network security attack response method based on the generative large model described in the present invention, the automatic labeling adopts a semantic clustering labeling algorithm based on the Embedding model, and realizes massive sample labeling by classifying, analyzing and normalizing known network security samples.

[0015] As a preferred solution of the network security attack response method based on the generative large model described in the present invention, data cleaning is performed by identifying and correcting data to improve data quality.

[0016] As a preferred solution of the network security attack response method based on the generative large model described in the present invention, the model training adopts deep learning to construct a deep neural network structure for learning the complex distribution of data.

[0017] As a preferred solution of the network security attack response method based on generative large model described in the present invention, the model fine-tuning adopts transfer learning method to pre-train the model on large-scale data so that it can learn general feature representation. The evaluation feedback includes:

[0018] Quantitative analysis of the model’s performance in various test scenarios;

[0019] Use machine learning algorithms to convert user feedback into guidance for model adjustments

[0020] To further solve the above technical problems, the present invention provides the following technical solutions: A network security attack response system based on a generative large model, comprising: an acquisition module, for automatically acquiring basic network security knowledge and network security attack method data to form a knowledge base;

[0021] A processing module is used to automatically classify and label the acquired data on basic network security knowledge and network security attack methods;

[0022] Modeling module, used to build and generate network security analysis models to clarify malicious and erroneous data;

[0023] A training module, used to perform network security training and fine-tune the acquired network security data;

[0024] The evaluation module is used to build an evaluation and feedback mechanism for the large network security model and ultimately respond to network security attacks.

[0025] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of the network security attack response method based on the generative large model as described above are implemented.

[0026] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the network security attack response method based on the generative large model as described above are implemented.

[0027] Beneficial effects of the present invention: The network security attack response method based on the generative large model provided by the present invention forms a knowledge base by automatically acquiring and processing network security data, combines Prompt engineering and Embedding models for intelligent classification and labeling, uses deep learning and transfer learning technology for model training and fine-tuning, and establishes a complete evaluation feedback mechanism, which can quickly identify and respond to various types of network security threats. This method not only improves the automation level and efficiency of network security analysis and reduces the cost of manual analysis, but also enables the model to adapt to the evolving network security threats through continuous learning and optimization, providing more intelligent and reliable technical support for network security protection of power systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0029] Figure 1 This is a schematic diagram of the overall process of a network security attack response method based on a generative large model proposed by the present invention;

[0030] Figure 2 This is a computer device diagram in a network security attack response method based on a generative large model proposed by the present invention. DETAILED DESCRIPTION

[0031] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0032] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0033] Example 1, reference Figure 1 , which is an embodiment of the present invention, provides a network security attack response method based on a generative large model.

[0034] S1: Metadata acquisition, automatically acquiring basic network security knowledge and network security attack method data to form a knowledge base;

[0035] S2: Classification and labeling: automatically classify and label the network security basic knowledge and network security attack method data obtained in the above step S1;

[0036] S3: Cleansing modeling, building and generating a network security analysis model to clarify malicious and erroneous data;

[0037] S4: Training and fine-tuning, performing network security training and fine-tuning on the acquired network security data;

[0038] S5: Evaluation and feedback, building an evaluation and feedback mechanism for the network security model, and ultimately responding to network security attacks.

[0039] The network security attack response method based on generative big models mainly involves multiple levels such as metadata acquisition, classification and annotation, cleaning modeling, training and fine-tuning, evaluation and feedback, to achieve network security against generative big models.

[0040] In specific settings, the data collected in step S1 includes general data, power-specific data, and security-specific data. The general data, power-specific data, and security-specific data are collected by automatically extracting public data from the Internet using crawling technology. The general data, power-specific data, and security-specific data are collected by cooperating with professional data providers to purchase legally authorized and strictly screened commercial security data.

[0041] Efficiently obtain metadata through a variety of methods, including using web crawling technology to automatically extract public data from the Internet, or cooperate with professional data providers to purchase legally authorized and strictly screened commercial security data. The collected data includes general data and special data on electricity and security to expand and improve their own network security corpus data center. Network security data crawling technology obtains open source network security attack and defense confrontation data sets to provide basic corpus data support for network security training. A web crawler is an automated program that can automatically traverse and obtain the required information on the Internet, and then store, analyze and apply this information. Data crawling is an application of web crawlers, and its purpose is to obtain the required data from the network and organize, clean and process the data for business needs. Principle: Obtain the initial URL based on an open source data set, including but not limited to public security data, security books and materials, network traffic records, technical reports and white papers, etc. By sending HTTP requests, parse the web page information and extract the required data from it. Use a suitable data storage format to save the extracted data to the local file system or database. It can be divided into the following steps:

[0042] 1. Seed URL initialization: Start with one or more initial web pages, usually the homepage or specific page of the target website specified by the user.

[0043] 2. Send HTTP request: The crawler sends an HTTP request to the seed URL to obtain the content of the web page. Usually, the crawler will simulate the behavior of the browser to avoid being recognized and blocked by the server.

[0044] 3. Parsing HTML content: After receiving the web page content, the crawler uses a parser to parse the HTML content and extract useful information from the page. The parser will analyze the HTML structure and find interesting data such as titles, text, links, pictures, etc.

[0045] 4. Data storage: The crawler stores the extracted data in a local or remote database for subsequent analysis and processing. The storage format can be JSON, CSV, SQL database, etc.

[0046] 5. Extract new URLs: The crawler extracts new links from the current page and adds them to the queue of URLs to be crawled. This process is called URL crawling or URL expansion.

[0047] 6. Repeat process: The crawler repeats the above steps, crawling new URLs, sending requests, parsing content, extracting and storing data in turn. This process will continue until the preset crawling conditions are met, such as time limit, page number limit or specific data amount.

[0048] 7. Deduplication and loop prevention: To improve efficiency and prevent loop crawling, the crawler maintains a list of visited URLs to ensure that each URL is crawled only once. This also helps avoid duplicate data storage.

[0049] Use HTML parsing technologies such as BeautifulSoup, lxml, and PyQuery to extract specific elements from the page. Use XPath or CSS selectors to locate page content. Use a distributed crawler system to improve crawling efficiency and data processing capabilities. Use asynchronous processing technologies such as multithreading and asynchronous I0 to improve the response speed of the crawler. Distributed crawler system: A web crawling solution composed of multiple crawler nodes. Compared with a single crawler, a distributed crawler system can process a wider range of web pages through distributed computing and collaborative work, improving crawling efficiency and data acquisition. Asynchronous processing technology: A technology that allows a program to continue to perform other tasks while waiting for certain operations to complete. Technical advantages: 1. Improve efficiency: Concurrent processing allows crawlers to extract data from multiple web pages or resources at the same time, greatly improving the efficiency of data collection. Asynchronous processing allows crawlers to continue to send new requests while processing a request, which means that the crawler can continue to work while waiting for data responses, making full use of network bandwidth and processing power. 2. Reduce latency: Since crawlers can process multiple requests in parallel, the time waiting for a single request response can be reduced, thereby improving the response speed of the entire data crawling process. 3. Improve stability: Through asynchronous processing, crawlers can better handle network delays, inconsistent server response times, and other issues, thereby improving the stability of data crawling. 4. Reduce resource consumption: Concurrent processing can effectively utilize the crawler's computing resources, such as CPU and memory, reducing the need for single-threaded processing, thereby reducing overall resource consumption.

[0050] The docking company shares commercial security data level and existing attack and defense confrontation data, providing prior knowledge for supervised training and fine-tuning of large models of power network security. You can obtain a large amount of high-quality and accurate data by purchasing threat intelligence services provided by security vendors while ensuring data security and compliance. The mainstream security vendors on the market currently include Alibaba Cloud, Weibu Online, and Green Alliance Threat Intelligence Center. The vendor introduction is as follows, and the purchase is made according to the actual situation of the project: Alibaba Cloud: The threat intelligence service provided combines global threat intelligence assessment and can automatically discover similar threat events to effectively identify potential threats in assets. Through platform services, using innovative technologies such as big data analysis and machine learning, it provides customers with intelligent and automated security protection capabilities. Weibu Online: Based on Weibu's unique intelligence production and quality control mechanism, more than 95% are high-quality self-developed intelligence production models, and local private intelligence is targeted to produce millions of highly reliable breach detection intelligence, with an intelligence accuracy rate of 99.99%; it reduces noise for daily massive false alarms and improves efficiency; richer intelligence fields provide a new evaluation perspective for the business. Professional platform management of professional data, establish a full-link closed-loop management of intelligence collection, processing, analysis, circulation, and feedback. NSFOCUS Threat Intelligence Center: Provides comprehensive threat intelligence services, including APT organization discovery, security reports, threat notifications, asset verification, cyberspace mapping, etc.

[0051] Specifically, the automatic classification in step S2 is based on the intelligent classification of network security data of different categories by the Prompt engineering model. The automatic labeling in step S2 is based on the semantic clustering labeling algorithm of the Embedding model, which labels the massive samples by classifying and analyzing the known network security samples and normalizing them.

[0052] Data classification is the process of classifying data according to certain standards or rules. In this process, data is divided into different categories or groups for further processing and analysis. Data classification can help computer algorithms better understand and process data, and improve the accuracy and efficiency of calculation methods. Data is divided into different categories or groups through machine learning algorithms, such as decision trees, support vector machines, neural networks, etc. The training set data is used to train the classification model, the model learns the characteristics and rules of the data, and then classifies the test set data. The classification of network security data of different categories is realized through the large model intelligent classification method based on the prompt project, providing data support for network security training. A small number of labeled samples are extracted from the samples to be labeled as references, and the relevant samples are found through detection, and the relevant samples are input into Few-shot Prompt, and the relevant samples are processed using the existing security labels and prior knowledge. The labeled samples are generated through a large model of hundreds of billions, and the sample labeling is completed.

[0053] Technical advantages: 1. Reduce semantic bias: The pre-training task is mainly based on MLM, while the downstream task re-introduces new training parameters, so the goals of the two stages are quite different. Therefore, it is necessary to solve the gap between Pre-Training and Fine-Tuning. 2. Avoid overfitting: Since the Fine-Tuning stage needs to introduce new parameters to adapt to the corresponding tasks, it is easy to overfit when the number of samples is limited, which reduces the generalization ability of the model. Therefore, it is necessary to solve the overfitting ability of the pre-training model.

[0054] Data annotation is the process of marking data so that computer algorithms can recognize and understand the characteristics and meaning of the data. Data annotation usually involves adding information such as labels, annotations, or descriptions to the data, which can help computer algorithms better understand and process the data. Data annotation can include various types of information, such as text annotation, image annotation, voice annotation, etc. Add information such as labels, annotations, or descriptions to the data so that computer algorithms can recognize and understand the characteristics and meaning of the data. Data annotation can be done manually or in a semi-automated way, such as using natural language processing technology to annotate text data and using image recognition technology to annotate image data.

[0055] Design a semantic clustering annotation algorithm based on the Embedding model. By classifying and normalizing known network security samples, we can annotate massive samples and solve the problem of difficulty in labeling massive samples. Relying on the embedding technology in deep learning, the data is converted into a continuous, high-dimensional vector representation. These vectors, or embedded vectors, can retain the semantic, structural and contextual information between data, so that the machine can perform the annotation task by learning the representation of these vectors. Data preprocessing: First, the original data is preprocessed. For example, text data may go through steps such as word segmentation, stop word removal, and stem extraction, while image data may need to be scaled, cropped, etc. to adapt to the subsequent embedding process. Feature extraction: Use a deep learning model to convert the preprocessed data into an embedded vector. In NLP, the word vector model can be used to learn the embedding vector of words and capture the semantic information of vocabulary. Model training: Train a labeling model, which is usually a supervised learning algorithm that uses existing labeled data to learn the rules of data labeling. During the training process, the model will continuously adjust its parameters to minimize the difference between the predicted labeling and the actual labeling. Embedding vector space: During the training process, the embedding vectors learned by the model can reflect the relationship between data in a high-dimensional space. For example, semantically similar words will have closer representations in the vector space. Annotation generation: Once the model is trained, it can annotate new data. After the embedding vectors of the new data are processed by the model, the model will output the corresponding annotation results. Optimization and adjustment: In actual applications, the annotation model may need to be continuously optimized and adjusted to adapt to new data distribution and annotation requirements. This process may include adjusting the model structure, updating training data, etc.

[0056] Technical advantages: Semantic understanding ability: The embedding model that uses word vectors to express text can deeply grasp the deep semantic associations between words, while traditional keyword-based search focuses more on literal matching and may ignore the deep semantics between words. In the fields of search engines, personalized knowledge question-and-answer systems, content recommendation systems, etc., this ability to capture deep semantics is particularly critical. Fault tolerance: The Embedding-based method can understand the relationship between words, thereby improving the fault tolerance of the model. When faced with erroneous or incomplete data, the Embedding model can better maintain its accuracy and reliability.

[0057] In the above specific implementation manner, the data cleaning in step S3 improves the data quality through the process of identifying and correcting the data, thereby ensuring the possibility of subsequent analysis or modeling.

[0058] Data cleaning refers to the process of identifying and correcting errors or inconsistencies in a data set, aiming to improve data quality and ensure the reliability of subsequent analysis or modeling. This includes operations such as identifying outliers, handling missing values, correcting errors, performing consistency conversions, removing duplicates, and feature engineering to make the data set more suitable for analysis and modeling requirements. Principle: Improve data quality and ensure the reliability of subsequent analysis or modeling by identifying and correcting errors or inconsistencies in the data set. This involves a series of operations such as identifying outliers, handling missing values, correcting errors, performing consistency conversions, removing duplicate records, and performing feature engineering, so that the data set is more accurate, complete, and consistent, and better meets the needs of analysis and modeling.

[0059] Rule-based cleaning technology is a data preprocessing method that aims to improve data quality by identifying and correcting errors, inconsistencies, and integrity issues in data sets through a series of predefined rules. This technology is very effective when processing structured data, such as database tables. It supports multiple rule types and complex logical operations between rules; supports three dirty data repair behaviors: retain, discard, and backfill; supports users to add, delete, or modify rules at runtime. Data conversion: Perform a detailed analysis of the data to identify possible errors, duplications, omissions, and other problems in the data, and preprocess and convert the data. Define cleaning rules: Define a series of cleaning rules based on the identified problems. Apply rules to clean data: Apply rules to data sets, identify data that does not comply with the rules, and make corresponding corrections. Verify the effect of rules: After cleaning, the data needs to be verified to ensure that the application of rules does not introduce new errors and improve the quality of the data.

[0060] Technical advantages: High accuracy: Rule-based cleaning technology can accurately identify and correct errors in data during data processing, which not only helps to improve the accuracy of data analysis and decision-making, but also reduces potential risks caused by data problems and ensures the normal operation of the business.

[0061] Furthermore, the model training in step S4 builds a deep neural network structure based on deep learning to learn the complex distribution of data. The model fine-tuning in step S4 is based on transfer learning to pre-train the model on large-scale data so that it learns a universal feature representation.

[0062] Model training refers to the use of large-scale data sets to train deep learning models with a large number of parameters to achieve representation and learning of complex data. Model training can capture the deep features of the data and improve the performance and generalization ability of the model. Based on deep learning, a deep neural network structure is built to learn the complex distribution of data. During the training process, the optimization algorithm is used to adjust the model parameters to minimize the difference between the prediction error and the actual data. Through continuous iteration and optimization, the model can gradually learn the characteristics and laws of the data, thereby improving the accuracy of prediction and classification. Mixed precision training is a technique that uses different data precisions in deep learning model training. This training method combines the advantages and disadvantages of using lower precision floating point numbers and higher precision floating point numbers to improve training efficiency and reduce memory usage while maintaining model performance. Automatic upscaling: Due to the small dynamic range of FP16, numerical stability problems may occur during training. By applying upscaling factors before and after gradient updates, this problem can be avoided and numerical stability can be maintained. Dynamic loss clipping: In FP16 training, in order to prevent gradient explosion, it is usually necessary to clip the loss. Dynamic loss clipping can automatically adjust the clipping threshold according to the size of the loss to maintain the stability of training. Optimizer state preservation: In mixed precision training, the optimizer state usually uses FP32 to maintain high numerical stability. This can avoid numerical errors accumulated during training. Gradient accumulation: In order to further improve efficiency, gradient accumulation technology can be used, that is, updating the model parameters after multiple iterations. This can reduce the number of model updates and improve GPU utilization.

[0063] Technical advantages: 1. Improved training speed: Using FP16 can significantly reduce GPU memory usage and bandwidth requirements, thereby accelerating the training process. 2. Energy efficiency: Reducing memory usage and computation means reducing energy consumption. 3. Model performance: Through appropriate numerical stability techniques, mixed precision training can be performed without sacrificing model performance.

[0064] Model fine-tuning refers to making small adjustments to a pre-trained large model on a new task to adapt to the new data distribution and requirements. This technique leverages the rich knowledge that large models have learned on a wide range of data to improve the performance of the model on new tasks through fine-tuning. The model is pre-trained on a large-scale dataset based on transfer learning so that it learns a common feature representation. The pre-trained model is transferred to a new task, and the top layer or some layers of the model are fine-tuned on the target task so that the model can adapt to the new data distribution and requirements. During the fine-tuning process, the underlying parameters of the model are usually frozen, and only the parameters of the top layer or some layers are updated to maintain the general knowledge learned by the model during the pre-training phase.

[0065] LoRA is a method for fine-tuning large pre-trained models. The core idea is to reduce the number of parameters that need to be updated during fine-tuning by introducing low-rank matrices to approximate the adaptive changes of the pre-trained model. This method can customize the model to adapt to specific tasks or domains while keeping most of the pre-trained model unchanged. In LoRA, the weights of the original model are divided into two parts: one part is the pre-trained weights, which remain fixed during the fine-tuning process; the other part is small low-rank matrices, which are used to simulate the impact of fine-tuning on the model weights. By optimizing these low-rank matrices, fine-tuning of the model output can be achieved without updating the entire model.

[0066] Technical advantages: 1. Parameter efficiency: LoRA only updates the low-rank matrix, which greatly reduces the number of parameters that need to be trained during fine-tuning, thereby reducing computational costs and storage requirements. 2. Preserving pre-trained knowledge: Since most of the pre-trained weights remain unchanged, LoRA helps to maintain the general knowledge learned by the model during the pre-training phase. 3. Easy to implement and integrate: LoRA is easy to integrate into existing pre-trained model frameworks with only minor modifications to the standard fine-tuning process. 4. Flexibility: LoRA allows users to adjust the size of the low-rank matrix as needed to balance performance and computing resources.

[0067] Specifically, the model evaluation in step S5 is based on a quantitative analysis of the performance of the model in various test scenarios; the model feedback optimization in step S5 converts user feedback into guidance for model adjustment through machine learning algorithms and data-driven.

[0068] The process of comprehensively evaluating the performance, effectiveness, security, and reliability of large AI models. Both manual and machine evaluations can be used. Manual evaluation: A team of experts tests and evaluates large models in actual application scenarios. This evaluation method focuses on the actual effect and user experience of the model. Machine evaluation: Large models are evaluated using preset evaluation algorithms and statistical models. This evaluation method focuses on the performance accuracy, stability, and efficiency of the model. It is based on quantitative analysis of the performance of the model in various test scenarios. This includes using a variety of benchmark datasets to test the generalization ability of the model, selecting appropriate evaluation indicators to measure the performance of the model, and evaluating the advantages and disadvantages of the model relative to other models through comparative experiments. Ablation experiments are used to analyze the impact of different components in the model, and robustness tests are used to test the model's resistance to abnormal inputs. Explanability and visualization techniques are used to reveal the decision logic and internal working status of the model, so as to more comprehensively evaluate the quality and reliability of the model.

[0069] Rule-based automatic evaluation method is an automatic evaluation technique that relies on predefined rules to evaluate the performance of the model. Rules are based on expert knowledge and experience and are used to determine whether the model meets certain specific standards or conditions. In the field of machine learning and data science, rule-based methods can be used for model validation, error analysis, performance evaluation, and model selection. The main steps include rule definition: First, a series of rules need to be defined, which are based on the expected behavior and performance criteria of the model. The rules can be based on performance indicators such as accuracy, recall, F1 score, ROC-AUC curve, etc. Rule evaluation: The effectiveness of the rules is evaluated using the performance data of the model on the test set. The rules may be adjusted and optimized based on the actual performance of the model. Error analysis: When the model does not meet certain rules, error analysis can be performed to understand in which cases the model performs poorly and find out the possible reasons. Performance evaluation: Based on the rules, the overall performance of the model can be evaluated and compared with other models or benchmarks. Model selection: Based on the results of the rule-based evaluation, the most suitable model can be selected for practical application.

[0070] Technical advantages: 1. Easy to understand: Rules are usually based on expert knowledge and experience, easy to understand and explain. 2. Flexibility: Different rules can be defined according to specific needs and scenarios. 3. Customizability: Rules can be customized according to specific performance standards to meet different evaluation needs.

[0071] Embodiment 2 is an embodiment of the present invention, which provides a network security attack response system based on a generative large model, including:

[0072] The acquisition module is used to automatically acquire basic network security knowledge and network security attack method data to form a knowledge base;

[0073] A processing module is used to automatically classify and label the acquired data on basic network security knowledge and network security attack methods;

[0074] Modeling module, used to build and generate network security analysis models to clarify malicious and erroneous data;

[0075] A training module, used to perform network security training and fine-tune the acquired network security data;

[0076] The evaluation module is used to build an evaluation and feedback mechanism for the large network security model and ultimately respond to network security attacks.

[0077] Example 3, reference Figure 2, is an embodiment of the present invention, which is different from the previous embodiment in that: if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0078] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0079] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0080] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0081] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security attack response method based on a generative large model, characterized in that: include: Acquire metadata, including automatically acquiring basic network security knowledge and network security attack method data to form a knowledge base; Classifying and labeling the metadata, including automatically classifying and labeling the basic network security knowledge and network security attack method data; Establish security models, including building network security analysis models to clean malicious and erroneous data; Performing model training, including training and fine-tuning on the cybersecurity data; Conduct evaluation and feedback, including building an evaluation and feedback mechanism for a large network security model to respond to network security attacks.

2. The network security attack response method based on the generative large model according to claim 1 is characterized by: The metadata includes general data, power-specific data, and security-specific data; Using crawling technology to automatically extract public data from the Internet to obtain the general data, power-specific data, and security-specific data; By cooperating with professional data providers, legally authorized and strictly screened commercial security data is obtained as the general data, power-specific data and security-specific data.

3. The network security attack response method based on the generative large model as claimed in claim 2 is characterized by: The automated classification uses a large model based on Prompt Engineering to intelligently classify different categories of network security data.

4. The network security attack response method based on the generative large model as claimed in claim 3 is characterized by: The automatic labeling adopts a semantic clustering labeling algorithm based on the Embedding model, and realizes the labeling of massive samples by classifying, analyzing and normalizing known network security samples.

5. The network security attack response method based on the generative large model as claimed in claim 4 is characterized by: Perform data cleansing to improve data quality by identifying and correcting data.

6. The network security attack response method based on the generative large model as claimed in claim 5 is characterized by: The model training uses deep learning to build a deep neural network structure for learning the complex distribution of data.

7. The network security attack response method based on the generative large model according to claim 6 is characterized by: The model fine-tuning adopts a transfer learning method to pre-train the model on large-scale data so that it can learn universal feature representation; The evaluation feedback includes: Quantitatively analyze the model’s performance in various test scenarios; Use machine learning algorithms to convert user feedback into model adjustment guidance.

8. A network security attack response system based on a generative large model, based on the network security attack response method based on a generative large model according to any one of claims 1 to 7, characterized in that: include, The acquisition module is used to automatically acquire basic network security knowledge and network security attack method data to form a knowledge base; A processing module is used to automatically classify and label the acquired data on basic network security knowledge and network security attack methods; Modeling module, used to build and generate network security analysis models to clarify malicious and erroneous data; A training module, used to perform network security training and fine-tune the acquired network security data; The evaluation module is used to build an evaluation and feedback mechanism for the large network security model and ultimately respond to network security attacks.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security attack response method based on the generative big model described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security attack response method based on a generative large model described in any one of claims 1 to 7 are implemented.

Images