A user identity threat detection method and system based on large language model

Abstract

The present invention discloses a user identity threat detection method and system based on a large language model in the field of network security technology, including establishing a model based on an open source deep learning framework, obtaining historical data set input and training the model to obtain a large language model, and the large language model is used to distinguish the characteristic differences between normal behavior and threatening behavior of user identity. The present invention deeply processes the collected data set through the established large language model, obtains data related to user identity threats and user multi-source data from multiple aspects of the network security data platform and the enterprise internal system, and constructs user behavior semantic association map data through the converted high-dimensional semantic vectors. Through multi-dimensional data analysis, it can deeply reveal user identity threat data, realize accurate and efficient detection and prevention of user identity threats, effectively reduce the false alarm rate and missed alarm rate, reduce the ineffective work of security management personnel, and improve the reliability of threat detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a user identity threat detection method and system based on a large language model. Background Art

[0002] User identity threats refer to potential security risks or malicious activity targeting user identity information in a network environment. These threats can originate from a variety of sources, including hacker attacks, malware, and phishing websites, and are intended to steal, tamper with, or misuse user identity information. This invention, by building a large language model and conducting in-depth analysis of user behavior, can accurately identify potential user identity threats, providing strong support for network security protection.

[0003] In the existing technology, the Chinese patent with patent number CN202410721431.0 discloses a "database user abnormal behavior detection method based on graph neural network model". Although the graph neural network model realizes the learning of complex relationships between user-behavior graphs and can provide real-time warnings of abnormal behaviors, and improves detection accuracy through multi-dimensional feature extraction, this method mainly revolves around structured data of database operation scenarios, such as SQL statement parsing and data table access statistics.

[0004] Existing user identity threat detection does not fully consider the fusion of multi-source data, making it difficult to meet the analysis needs of cross-platform user identity threats. It has poor results in in-depth analysis of multi-source data, and has certain limitations in its adaptive learning capabilities in dynamic threat environments, resulting in poor performance. Summary of the Invention

[0005] The purpose of the present invention is to provide a user identity threat detection method and system based on a large language model to solve the above-mentioned problems of insufficient consideration of multi-source data fusion, difficulty in meeting the analysis needs of cross-platform user identity threats, and poor effect of in-depth analysis of multi-source data.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for detecting user identity threats based on a large language model, characterized by comprising:

[0008] Building a model based on an open source deep learning framework, obtaining historical data set input and training the model to obtain a large language model, which is used to distinguish the characteristic differences between normal behavior and threatening behavior of user identities;

[0009] A data collection crawler is customized and developed based on a web crawler framework. The network security data platform is deeply analyzed according to the large language model, and user identity threat intelligence data is obtained through the data collection crawler. The data collection crawler obtains multi-source user data from the enterprise's internal system, compresses the user identity threat intelligence data and multi-source data to obtain a collection data set, imports the collection data set into the data processing platform, and cleans and annotates the data through the large language model to obtain a labeled data set.

[0010] Parsing and extracting the labeled data set based on a cluster computing system and a large language model to obtain a feature data set, wherein the feature data set includes login features, operation features, and permission features;

[0011] Based on the word vector model, the feature data set is converted into a high-dimensional semantic vector, and the high-dimensional semantic vector is input into a large language model to construct user behavior semantic association graph data;

[0012] Inputting the feature data set and user behavior semantic association graph data into a large language model, the large language model calculating threat probability data and generating a threat report;

[0013] Initiate a preset real-time response mechanism based on the threat report, the real-time response mechanism including a response mechanism preset in the enterprise's internal system and a response mechanism preset in the network security data platform;

[0014] Historical event data is acquired and input into the large language model, and the preset parameters and real-time response mechanism of the large language model are adjusted.

[0015] As a further solution of the present invention, the model is established based on an open source deep learning framework, a historical data set is obtained as input, and the model is trained to obtain a large language model. The large language model is used to distinguish the characteristic differences between normal behavior and threatening behavior of user identities, including:

[0016] The historical data includes the user's historical normal behavior data and threatening behavior data obtained by the network security data platform and the user's normal behavior data and threatening behavior data obtained by the enterprise's internal system;

[0017] Historical data is input into the model and trained to obtain a large language model, wherein the model training process adopts supervised learning, normal behavior data in the historical data set is marked as 0 and threatening behavior data is marked as 1, and the model is trained and optimized based on an adaptive learning rate optimization algorithm and a cross-entropy loss function to obtain a large language model, so that the large language model can distinguish the characteristic differences between normal behavior and threatening behavior of user identity.

[0018] As a further solution of the present invention, the data collection crawler is customized and developed based on the web crawler framework, the network security data platform is deeply analyzed according to the large language model, and user identity threat intelligence data is obtained through the data collection crawler. The data collection crawler obtains multi-source data of users in the enterprise internal system, and the user identity threat intelligence data and the multi-source data are compressed to obtain a collection data set, including:

[0019] The large language model deeply analyzes the page structure, data interface specifications, and update frequency of the network security data platform, and automatically sends data requests to the network security data platform at a preset time through the data collection crawler, and obtains user identity threat intelligence data of the network security data platform worldwide, and the user identity threat intelligence data includes malicious behavior pattern data and identity theft data;

[0020] Processing and acquiring multi-source user data from the enterprise internal system within a preset time period based on the data acquisition crawler data, the multi-source data including user login time, user login log, user IP address, and user operation behavior;

[0021] The user identity threat intelligence data, user login time, user login log, user IP address and user operation behavior are compressed to obtain a collection data set to improve the transmission efficiency of the collection data set.

[0022] As a further solution of the present invention: importing the collected data set into a data processing platform and performing cleaning and data annotation using a large language model to obtain a labeled data set includes:

[0023] Identify the collected data set according to the large language model and clean up format errors and redundant data;

[0024] The labeling tool based on the large language model labels the cleaned collected data set, labels the preset financial and privacy information in the collected data set as a high-sensitivity data set, and labels the preset routine business information in the collected data set as a low-sensitivity data set. The role data set is obtained according to the user's department information. The high-sensitive data set, the low-sensitive data set and the role data set form a labeled data set, and the labeled data set is used to determine the user behavior type.

[0025] As a further solution of the present invention: the step of parsing and extracting the labeled dataset based on a cluster computing system and a large language model to obtain a feature dataset includes:

[0026] The labeled data set is based on a cluster computing system and a large language model to parse and extract the user's precise login time, longitude and latitude, device type, file name, file type, file operation type, change time and permission content and integrate them into a processed feature data set, which includes login features, operation features and permission features.

[0027] As a further solution of the present invention: the feature data set is converted into a high-dimensional semantic vector based on a word vector model, and the high-dimensional semantic vector is input into a large language model to construct user behavior semantic association graph data, including:

[0028] Converting the user's operation features in the feature dataset into high-dimensional semantic vectors based on a word vector model;

[0029] The high-dimensional semantic vector is input into the large language model, and the cosine similarity between different high-dimensional semantic vectors is calculated based on the semantic analysis of the large language model to construct a user behavior semantic association map.

[0030] As a further solution of the present invention, the feature data set and user behavior semantic association graph data are input into a large language model, and the large language model calculates threat probability data and generates a threat report, including:

[0031] Inputting the processed feature dataset and user behavior semantic association graph data into a large language model;

[0032] If the feature data set and user behavior semantic association graph data trigger a preset abnormality threshold in the large language model, threat probability data is generated. The threat probability data is graded and classified into several levels by the large language model. The large language model generates a detailed threat report based on the graded and classified threat probability data. The threat report includes an external threat report of the network security data platform and an internal threat report of the enterprise's internal system.

[0033] Generate warning information according to the threat report, and send the warning information based on an Internet message service, wherein the warning information includes threat time, location, user and resource information.

[0034] As a further solution of the present invention: the preset real-time response mechanism is initiated according to the threat report, and the real-time response mechanism includes a response mechanism preset in the enterprise internal system and a response mechanism preset in the network security data platform, including:

[0035] Initiating a response mechanism preset by the network security data platform based on the level classification and classification corresponding to the external threat report of the network security data platform in the threat report, wherein the response mechanism preset by the network security data platform includes freezing the relevant user account through the application programming interface of the identity authentication system;

[0036] The level classification and classification corresponding to the internal threat report of the enterprise internal system in the threat report triggers a response mechanism preset in the enterprise internal system, wherein the response mechanism preset in the enterprise internal system includes an application programming interface of the rights management system to restrict access rights and retain preset rights;

[0037] A detailed investigation process is initiated based on automated scripts to collect relevant operation logs and evidence.

[0038] As a further solution of the present invention, the steps of obtaining historical event data and inputting it into the large language model, and adjusting the preset parameters and real-time response mechanism of the large language model include:

[0039] The historical event data includes successfully blocked threat event data and missed threat event data, and the preset parameters and real-time response mechanism of the large language model are adjusted according to the historical event data.

[0040] In a second aspect, the present invention provides a user identity threat detection system based on a large language model, the system comprising:

[0041] Establishing a training model module, wherein the training model module is used to establish a model based on an open source deep learning framework, obtain historical data set input and train the model to obtain a large language model;

[0042] A data acquisition module, wherein the data acquisition module is used to customize and develop a data acquisition crawler based on a web crawler framework, deeply analyze the network security data platform according to the large language model, and obtain user identity threat intelligence data through the data acquisition crawler. The data acquisition crawler obtains multi-source user data from the enterprise's internal system, compresses the user identity threat intelligence data and the multi-source data to obtain a collection data set, imports the collected data set into the data processing platform, cleans and annotates the data through the large language model, and obtains a labeled data set;

[0043] An extraction processing module, configured to parse and extract the labeled data set based on a cluster computing system and a large language model to obtain a feature data set;

[0044] A conversion module, which is used to convert the feature data set into a high-dimensional semantic vector based on a word vector model, and input the high-dimensional semantic vector into a large language model to construct user behavior semantic association graph data;

[0045] A calculation and generation module, the calculation and generation module is used to input the feature data set and the user behavior semantic association graph data into a large language model, the large language model calculates threat probability data and generates a threat report;

[0046] A response module, the response module is used to initiate a preset real-time response mechanism according to the threat report, the real-time response mechanism including a response mechanism preset in the enterprise internal system and a response mechanism preset in the network security data platform;

[0047] An adjustment module is used to obtain historical event data and input it into the large language model, and adjust the preset parameters and real-time response mechanism of the large language model.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. In the present invention, the collected data set is deeply processed through the established large language model, and data related to user identity threats and user multi-source data are obtained from multiple aspects of the network security data platform and the enterprise's internal system. The user behavior semantic association graph data is constructed through the converted high-dimensional semantic vectors. Through multi-dimensional data analysis, the user identity threat data can be deeply revealed, and accurate and efficient detection and prevention of user identity threats can be achieved, effectively reducing the false alarm rate and missed alarm rate, reducing the ineffective work of security management personnel, and improving the reliability of threat detection.

[0050] 2. In the present invention, by initiating a preset real-time response mechanism based on threat reports, the system can respond quickly when a potential threat is detected, avoiding the delay and uncertainty of manual intervention, thereby effectively improving the timeliness and accuracy of threat response. The synergy between the response mechanism preset in the enterprise's internal system and the response mechanism preset in the network security data platform ensures that threat information can be efficiently transmitted and processed across platforms, further enhancing the overall security performance of the system. In addition, through intelligent optimization of threat responses and preset parameter adjustments based on historical event data, the large language model can adaptively learn to continuously adapt to the dynamic threat environment, providing more comprehensive and effective protection for user identity security. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 Schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0053] Example:

[0054] See also Figure 1In an embodiment of the present invention, a method for detecting user identity threats based on a large language model includes:

[0055] S1: Build a model based on an open source deep learning framework, obtain historical data set input and train the model to obtain a large language model. The large language model is used to distinguish the characteristic differences between normal behavior and threatening behavior of user identities;

[0056] S2: Customize and develop a data collection crawler based on a web crawler framework. Use the large language model to deeply analyze the network security data platform and obtain user identity threat intelligence data through the data collection crawler. The data collection crawler obtains multi-source user data from the enterprise's internal system, compresses the user identity threat intelligence data and multi-source data to obtain a collection data set, imports the collection data set into the data processing platform, and uses the large language model to clean and annotate the data to obtain a labeled data set.

[0057] S3: Analyze and extract the labeled dataset based on the cluster computing system and the large language model to obtain a feature dataset, where the feature dataset includes login features, operation features, and permission features;

[0058] S4: Based on the word vector model, the feature dataset is converted into a high-dimensional semantic vector, and the high-dimensional semantic vector is input into the large language model to construct the user behavior semantic association graph data;

[0059] S5: Input the feature dataset and user behavior semantic association graph data into the large language model, and the large language model calculates the threat probability data and generates a threat report;

[0060] S6: Initiate a preset real-time response mechanism based on the threat report. The real-time response mechanism includes the response mechanism preset in the enterprise's internal system and the response mechanism preset in the network security data platform.

[0061] S7: Obtain historical event data and input it into the large language model, and adjust the preset parameters and real-time response mechanism of the large language model.

[0062] Specifically, the present invention uses the natural language processing and knowledge reasoning capabilities of the established large language model to deeply process the collected data set, obtain user identity threat-related data and user multi-source data from multiple aspects of the network security data platform and the enterprise's internal system, and construct user behavior semantic association graph data through the converted high-dimensional semantic vectors. Through multi-dimensional data analysis, it can deeply reveal user identity threat data, achieve accurate and efficient detection and prevention of user identity threats, effectively reduce the false alarm rate and missed alarm rate, reduce the ineffective work of security management personnel, and improve the reliability of threat detection;

[0063] Furthermore, by initiating a preset real-time response mechanism based on threat reports, the system can respond quickly when potential threats are detected, avoiding the delay and uncertainty of manual intervention, thereby effectively improving the timeliness and accuracy of threat responses. The synergy between the response mechanism preset in the enterprise's internal system and the response mechanism preset in the network security data platform ensures that threat information can be efficiently transmitted and processed across platforms, further enhancing the overall security performance of the system. In addition, through intelligent optimization of threat responses and preset parameter adjustments based on historical event data, the large language model can adaptively learn to continuously adapt to the dynamic threat environment, providing more comprehensive and effective protection for user identity security.

[0064] Preferably, a model is established based on an open source deep learning framework, historical data sets are input and trained to obtain a large language model. The large language model is used to distinguish the characteristic differences between normal and threatening behaviors of user identities, including:

[0065] Open source deep learning frameworks, including the PyTorch framework, are used to build models. PyTorch is an open source deep learning framework, such as the GPT series, which learns language patterns and regularities through unsupervised learning on large-scale text data. Historical data includes historical user behavior data (normal and threatening) obtained by the network security data platform and user behavior data (normal and threatening) obtained by the enterprise's internal systems.

[0066] Historical data is input and the model is trained to obtain a large language model. The model training process adopts supervised learning, and the normal behavior data in the historical data set is marked as 0 and the threatening behavior data is marked as 1. The optimization model is trained based on the adaptive learning rate optimization algorithm and the cross-entropy loss function to obtain a large language model, which enables the large language model to distinguish the characteristic differences between normal behavior and threatening behavior of user identity.

[0067] Specifically, the adaptive learning rate optimization algorithm includes the Adam optimizer, which is widely used in various deep learning tasks, such as image classification, object detection, and natural language processing. Many deep learning frameworks provide implementations of the Adam optimizer for user convenience. Normal behavior is marked as 0 and threatening behavior is marked as 1. The Adam optimizer is used with the cross-entropy loss function for 100 training rounds. Early stopping is used to avoid overfitting, allowing the model to learn to distinguish the characteristic differences between normal and threatening behaviors.

[0068] Preferably, a data collection crawler is customized and developed based on a web crawler framework. The network security data platform is deeply analyzed according to a large language model, and user identity threat intelligence data is obtained through the data collection crawler. The data collection crawler obtains multi-source user data from the enterprise's internal system, and the user identity threat intelligence data and multi-source data are compressed to obtain a collection data set, including:

[0069] The large language model deeply analyzes the page structure, data interface specifications, and update frequency of the network security data platform. It automatically sends data requests to the network security data platform at preset times through data collection crawlers, and obtains user identity threat intelligence data from network security data platforms worldwide. User identity threat intelligence data includes malicious behavior pattern data and identity theft data;

[0070] Based on the data collection crawler data, the system processes and obtains multi-source user data from the enterprise internal system within a preset time period. The multi-source data includes user login time, user login log, user IP address and user operation behavior;

[0071] The user identity threat intelligence data, user login time, user login log, user IP address and user operation behavior are compressed to obtain the collection data set to improve the transmission efficiency of the collection data set, ensure that the collection data set fully covers the data collected in the network security data platform and the enterprise's internal system and is updated within the preset time.

[0072] Among them, the web crawler framework includes Python's Scrapy framework, which is used to customize and develop efficient data collection crawlers. The large language model deeply analyzes the page structure, data interface specifications and update frequency of the network security data platform. The network security data platform includes Kaspersky Threat Intelligence Portal, Symantec Security Response, etc. Through its powerful natural language processing capabilities, the large language model can accurately understand and parse the complex page structure of the network security data platform to ensure the accuracy and completeness of data collection. At the same time, it also conducts a detailed study of the platform's data interface specifications to ensure that the data collection crawler can interact with the platform efficiently and stably. In addition, the large language model will also pay close attention to the platform's update frequency and adjust the data collection strategy in a timely manner to cope with possible changes in the platform's page structure or data interface, thereby ensuring the continuity and timeliness of data collection. The preset time is 5 minutes to 30 minutes, preferably 10 minutes, to obtain the latest user identity threat intelligence worldwide;

[0073] Data collection and crawling include ETL tools, which stands for Extract, Transform, and Load, encompassing the process of extracting, transforming, and loading data. Data collection occurs during a preset timeframe, from 2:00 AM to 6:00 AM. The ETL tool collects comprehensive data from internal enterprise systems (such as network access logs and permission management systems), including user login times, IP addresses, and operational behavior. Effective use of ETL tools can significantly improve data collection efficiency and accuracy, providing a solid foundation for subsequent user identity threat detection.

[0074] Taking the Kaspersky Threat Intelligence Portal as an example, a large language model parses its data interface documentation to determine the parameters and format of data requests. Using Scrapy's scheduler, it automatically sends data requests to the platform every 10 minutes to obtain the latest global user identity threat intelligence, including malicious behavior patterns and identity theft cases. Simultaneously, ETL tools are used to collect user login time, IP addresses, and operational behavior data from internal enterprise systems (such as network access logs and permission management systems) at 2:00 AM, when system load is low. Data compression technology is used to improve transmission efficiency, ensuring comprehensive coverage and timely updates of internal and external data.

[0075] Preferably, the collected data set is imported into a data processing platform and cleaned and annotated using a large language model to obtain a labeled data set, including:

[0076] Identify the collected data set based on the large language model and clean up format errors and redundant data;

[0077] The labeling tool based on the large language model labels the cleaned collected data set, labels the preset financial and privacy information in the collected data set as a highly sensitive data set, and labels the preset routine business information in the collected data set as a less sensitive data set. The role data set is obtained based on the user's department information. The highly sensitive data set, the less sensitive data set, and the role data set form a labeled data set, which is used to determine the user behavior type.

[0078] Specifically, data processing platforms include Hadoop, an open-source, scalable distributed computing platform developed by the Apache Software Foundation. Hadoop is primarily used to process large data sets and can run on clusters consisting of a large number of standard servers, providing an efficient and reliable solution for storing and processing massive amounts of data.

[0079] The collected dataset is imported into the Hadoop platform. Using the large language model combined with regular expressions and semantic analysis, format errors and redundant data are identified and cleaned. The tagging tool developed based on the large language model uses part-of-speech tagging and named entity recognition technology to annotate the cleaned data. Taking user operation behavior data as an example, part-of-speech tagging technology is used to identify operation verbs (such as "login," "read," and "modify") to determine the type of user behavior. Named entity recognition technology is used to identify entities such as user names and file names, and the sensitivity of the data is determined by combining the large language model's understanding of business logic. The preset financial and privacy information includes financial data and customer privacy information. Operations involving financial data and customer privacy information are marked as highly sensitive, resulting in a highly sensitive dataset. The preset routine business includes routine operations on ordinary business documents. Routine operations on ordinary business documents are marked as low sensitive, resulting in a low-sensitivity dataset. Based on the user's department and position information, the knowledge graph technology of the large language model is used to determine the user role (such as ordinary employee, department manager, system administrator, etc.), resulting in a role dataset, providing clear and accurate labeled data for subsequent feature extraction and analysis.

[0080] Preferably, the labeled dataset is parsed and extracted based on a cluster computing system and a large language model to obtain a feature dataset, including:

[0081] The labeled dataset is parsed and extracted based on a cluster computing system and a large language model to obtain the user's precise login time, longitude and latitude, device type, file name, file type, file operation type, change time, and permission content, and integrated into a processed feature dataset. The feature dataset includes login features, operation features, and permission features.

[0082] The cluster computing system, which includes the Spark platform and the pandas library, processes labeled datasets and extracts basic features using large language model parsing capabilities. Labeled datasets include login logs, which parse precise login time, latitude and longitude (using GeoPy), and device type. Labeled datasets also extract file name, type, and operation type from file operation records. Labeled datasets also extract change time, permission details, and other features from permission change records. This integration creates a dataset encompassing three basic features: login, operation, and permission, providing support for in-depth analysis.

[0083] Preferably, the feature dataset is converted into a high-dimensional semantic vector based on a word vector model, and the high-dimensional semantic vector is input into a large language model to construct a user behavior semantic association graph data, including:

[0084] Based on the word vector model, the user's operation features in the feature dataset are converted into high-dimensional semantic vectors;

[0085] The high-dimensional semantic vector is input into the large language model, and the cosine similarity between different high-dimensional semantic vectors is calculated based on the semantic analysis of the large language model to construct a semantic association map of user behavior.

[0086] This graph intuitively displays correlations and patterns between user behaviors, helping to identify anomalous behavior. By setting thresholds, when the cosine similarity falls below or rises above a preset value, an alert is triggered, alerting users of potential identity threats. Furthermore, the graph can be dynamically updated, continuously optimizing the user behavior model as new data is added, improving detection accuracy and timeliness.

[0087] Specifically, based on word embedding models, including the BERT word embedding model, BERT word embedding technology is used to convert the text of operation features in the feature dataset into high-dimensional semantic vectors (for example, "User Zhang San read the financial quarterly report .docx file at 10:00 on October 10, 2024" generates a 768-dimensional vector). By leveraging the semantic analysis capabilities of a large language model, the cosine similarity between different operation behavior vectors is calculated to construct a semantic association graph of user behavior. A similarity threshold of 0.7 is set to identify behavioral pattern associations. When the similarity between two operation behavior vectors exceeds this threshold, the two behaviors are considered to have a strong semantic connection. For example, if a user frequently reads financial report files, when a new operation involving reading financial-related files occurs, the similarity between its behavior vector and the historical behavior vector is high, indicating that the behavior is consistent with the user's normal behavior pattern. Conversely, if the similarity is low, it may be an anomaly. By constructing a semantic association graph, potential changes and correlations in user behavior patterns can be identified, providing deeper semantic feature evidence for threat detection.

[0088] A user behavior profiling algorithm is trained based on a large language model, and time series analysis is used to determine the user's regular login times. For example, by analyzing user login time data from the past month, it was found that User A typically logged in between 9:00 AM and 6:00 PM on weekdays, with peak login times concentrated between 9:30 AM and 10:30 AM. By statistically analyzing the types and frequency of file accesses, combined with the semantic understanding of file content by the large language model, the user's business needs and work habits can be understood. If a user frequently accesses sales data report files and frequently reads and analyzes these files, this indicates that their work may be related to sales data analysis. By combining user role and permission information and leveraging the knowledge reasoning capabilities of the large language model, the user behavior profile is refined and dynamically adjusted. For example, a system administrator user has higher permissions, and their operations may involve advanced operations such as system configuration changes and user permission management. Meanwhile, an employee user has lower permissions and primarily performs daily business operations. Whenever a user's role or permissions change, the model updates the user behavior profile in real time based on the new information, ensuring that the profile accurately reflects the user's normal behavior patterns.

[0089] A large language model is used to statistically analyze historical data, and personalized anomaly thresholds are set for each user based on the 3σ principle: a login location that deviates by more than 5 degrees from the permanent residence and a login time that deviates by 3 standard deviations from the mean are considered abnormal; a file access frequency that exceeds 3 times the historical mean or an unconventional operation type (such as an ordinary employee attempting to modify permissions) triggers an alert. These thresholds will serve as important reference standards for subsequent threat detection, used to determine whether user behavior deviates from normal patterns.

[0090] Preferably, the feature data set and user behavior semantic association graph data are input into a large language model, and the large language model calculates threat probability data and generates a threat report, including:

[0091] Input the processed feature dataset and user behavior semantic association graph data into the large language model;

[0092] If the feature dataset and user behavior semantic association graph data trigger the preset abnormality threshold in the large language model, threat probability data is generated. The threat probability data is graded and classified into several levels by the large language model. The large language model generates a detailed threat report based on the graded and classified threat probability data. The threat report includes external threat reports for the network security data platform and internal threat reports for the enterprise's internal systems.

[0093] Generate warning information based on the threat report and send it through an Internet-based message service, where the warning information includes the threat time, location, user, and resource information.

[0094] Specifically, the feature data set and user behavior semantic association map data collected in real time are input into the trained large language model to trigger the preset abnormal threshold and calculate the threat probability. If the abnormal threshold is triggered (for example, three remote logins + abnormal devices + unauthorized access within 10 minutes), the Internet messaging services include SMS gateways and email services. The system sends an early warning to security personnel through the SMS gateways and email services, including the threat time (accurate to the second), location (IP resolution to the street level), user and resource information to ensure timely response.

[0095] Once a threat is detected, it is classified and graded using a large language model. Based on the nature, source, and potential impact of the threat, threats are categorized into identity theft threats from external hackers, malicious operations from internal employees, privilege abuse risks, and abnormal account sharing threats. By analyzing the behavioral characteristics of the threat, the large language model's text classification technology is used to determine the threat category. For example, if a large number of brute force login attempts are initiated from an external IP address, and the accounts used to log in are commonly used business accounts, the large language model can be used to analyze the behavioral patterns and characteristics and identify them as identity theft threats from external hackers. Furthermore, based on factors such as the sensitivity of the data involved, the business scope affected, and the potential financial losses, threats are graded into several levels, including high, medium, and low. Threats involving the leakage of highly sensitive data (such as customer ID numbers and bank card information) that could disrupt the normal operation of core businesses and result in significant financial losses are classified as high-level threats. Threats involving the leakage of general business data with a moderate impact on business operations but minimal financial losses are classified as medium-level threats. Threats involving only a small amount of abnormal operation of non-sensitive data with minimal business impact are classified as low-level threats. So that security managers can take appropriate countermeasures based on the severity of the threat.

[0096] Based on threat signatures and relevant knowledge, the large language model generates detailed threat reports. These reports include threat details, such as the number of brute force logins and abnormal operation content, a risk assessment, including data security and business impact, and recommended countermeasures, such as account freezing and IP tracking. For example, an external theft threat report must include the attacking IP address, the affected account's permission level, and the emergency response process, enabling security personnel to quickly develop a sound response plan.

[0097] Preferably, a preset real-time response mechanism is initiated based on the threat report. The real-time response mechanism includes a response mechanism preset in the enterprise's internal system and a response mechanism preset in the network security data platform, including:

[0098] Initiate the response mechanism preset by the cybersecurity data platform based on the level and classification of the external threat report in the threat report. The response mechanism preset by the cybersecurity data platform includes freezing the relevant user accounts through the application programming interface of the identity authentication system.

[0099] The corresponding level classification and classification of internal threat reports to the enterprise's internal system in the threat report triggers the response mechanism preset in the enterprise's internal system. The response mechanism preset in the enterprise's internal system includes the application programming interface of the permission management system to limit access rights and retain the preset permissions;

[0100] A detailed investigation process is initiated based on automated scripts to collect relevant operation logs and evidence.

[0101] Specifically, upon receiving a threat alert, the system automatically initiates a real-time response mechanism. Different countermeasures are implemented based on the threat type and severity. For high-risk identity theft threats from external hackers, the system immediately freezes the relevant user account through the identity authentication system's application programming interface (API), preventing further operations. Simultaneously, an SMS gateway interface is used to send an emergency notification containing threat details to the security manager's mobile phone, such as "An external hacker has been detected attempting a brute force login attack on user [username]'s account. The account has been frozen. Please address this promptly." For malicious operational threats from internal employees, the system utilizes the API of a permissions management system (such as Windows Server Active Directory Permission Management) to restrict the employee's access rights to only pre-defined permissions, including essential permissions (such as the ability to view personal work tasks). Automated scripts initiate a detailed investigation process, collecting relevant operation logs and evidence. For example, all operation records of the employee before and after the threat are extracted from network access logs and business operation record systems and stored in a dedicated investigation database for subsequent in-depth analysis.

[0102] Preferably, obtaining historical event data and inputting it into a large language model, and adjusting the preset parameters and real-time response mechanism of the large language model include:

[0103] Historical event data includes successfully blocked threat event data and missed threat event data. The preset parameters and real-time response mechanism of the large language model are adjusted based on the historical event data.

[0104] Specifically, the large language model analyzes historical events to summarize successful defense experiences and lessons learned from failures. For example, in analyzing a case study that successfully prevented an external hacker attack, the large language model conducts in-depth analysis of the attack behavior characteristics, detection process, and response measures, resulting in effective detection rules and response strategies, such as promptly detecting abnormal login behavior and swiftly freezing accounts. Another example involves analyzing a previously unreported threat event to identify shortcomings in the model's detection process, such as an overly permissive detection rule that failed to detect the threat in a timely manner. These lessons learned are then fed back into the threat detection model and response mechanism to adjust the model parameters and response strategies. If an improperly set detection threshold is found to have resulted in a missed detection, the large language model recalculates and adjusts the threshold based on historical data. The large language model analyzes large amounts of historical data and current threat intelligence to predict potential threat trends. By leveraging time series analysis, machine learning algorithms (such as decision trees and random forests), and the knowledge reasoning capabilities of the large language model, new threat patterns and attack methods are predicted, such as new identity theft attacks that use AI to evade detection. Preemptive defense strategies can be formulated, such as developing new detection algorithms and updating defense rules, to achieve proactive defense.

[0105] A user identity threat detection system based on a large language model, applying the above method, includes:

[0106] Establish a training model module, which is used to build a model based on an open source deep learning framework, obtain historical data set input, and train the model to obtain a large language model;

[0107] The data acquisition module is used to customize and develop a data collection crawler based on a web crawler framework. It deeply analyzes the network security data platform based on a large language model and obtains user identity threat intelligence data through the data collection crawler. The data collection crawler obtains multi-source user data from the enterprise's internal system, compresses the user identity threat intelligence data and multi-source data to obtain a collection data set, imports the collection data set into the data processing platform, and uses the large language model to clean and annotate the data to obtain a labeled data set.

[0108] An extraction processing module is used to parse and extract the labeled data set based on the cluster computing system and the large language model to obtain a feature data set;

[0109] The conversion module is used to convert the feature dataset into a high-dimensional semantic vector based on the word vector model. The high-dimensional semantic vector is input into the large language model to construct the user behavior semantic association graph data;

[0110] The calculation and generation module is used to input the feature data set and the user behavior semantic association graph data into the large language model. The large language model calculates the threat probability data and generates a threat report;

[0111] Response module: The response module is used to initiate a preset real-time response mechanism based on the threat report. The real-time response mechanism includes the response mechanism preset in the enterprise internal system and the response mechanism preset in the network security data platform;

[0112] The adjustment module is used to obtain historical event data and input it into the large language model, and adjust the preset parameters and real-time response mechanism of the large language model.

[0113] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A user identity threat detection method based on a large language model, characterized in that: include: Building a model based on an open source deep learning framework, obtaining historical data set input and training the model to obtain a large language model, which is used to distinguish the characteristic differences between normal behavior and threatening behavior of user identities; A data collection crawler is customized and developed based on a web crawler framework. The network security data platform is deeply analyzed according to the large language model, and user identity threat intelligence data is obtained through the data collection crawler. The data collection crawler obtains multi-source user data from the enterprise's internal system, compresses the user identity threat intelligence data and multi-source data to obtain a collection data set, imports the collection data set into the data processing platform, and cleans and annotates the data through the large language model to obtain a labeled data set. Parsing and extracting the labeled data set based on a cluster computing system and a large language model to obtain a feature data set, wherein the feature data set includes login features, operation features, and permission features; Based on the word vector model, the feature data set is converted into a high-dimensional semantic vector, and the high-dimensional semantic vector is input into a large language model to construct user behavior semantic association graph data; Inputting the feature data set and user behavior semantic association graph data into a large language model, the large language model calculating threat probability data and generating a threat report; Initiate a preset real-time response mechanism based on the threat report, the real-time response mechanism including a response mechanism preset in the enterprise's internal system and a response mechanism preset in the network security data platform; Historical event data is acquired and input into the large language model, and the preset parameters and real-time response mechanism of the large language model are adjusted.

2. The user identity threat detection method based on a large language model according to claim 1, characterized in that: The model is established based on an open source deep learning framework, and historical data sets are obtained and trained to obtain a large language model. The large language model is used to distinguish the characteristic differences between normal behavior and threatening behavior of user identities, including: The historical data includes the user's historical normal behavior data and threatening behavior data obtained by the network security data platform and the user's normal behavior data and threatening behavior data obtained by the enterprise's internal system; Historical data is input into the model and trained to obtain a large language model, wherein the model training process adopts supervised learning, normal behavior data in the historical data set is marked as 0 and threatening behavior data is marked as 1, and the model is trained and optimized based on an adaptive learning rate optimization algorithm and a cross-entropy loss function to obtain a large language model, so that the large language model can distinguish the characteristic differences between normal behavior and threatening behavior of user identity.

3. The user identity threat detection method based on a large language model according to claim 2, characterized in that: The data collection crawler is customized and developed based on the web crawler framework, the network security data platform is deeply analyzed according to the large language model, and user identity threat intelligence data is obtained through the data collection crawler. The data collection crawler obtains multi-source data of users in the enterprise internal system, and the user identity threat intelligence data and multi-source data are compressed to obtain a collection data set, including: The large language model deeply analyzes the page structure, data interface specifications, and update frequency of the network security data platform, and automatically sends data requests to the network security data platform at a preset time through the data collection crawler, and obtains user identity threat intelligence data of the network security data platform worldwide, and the user identity threat intelligence data includes malicious behavior pattern data and identity theft data; Processing and acquiring multi-source user data from the enterprise internal system within a preset time period based on the data acquisition crawler data, the multi-source data including user login time, user login log, user IP address, and user operation behavior; The user identity threat intelligence data, user login time, user login log, user IP address and user operation behavior are compressed to obtain a collection data set to improve the transmission efficiency of the collection data set.

4. The user identity threat detection method based on a large language model according to claim 3, characterized in that: The step of importing the collected data set into a data processing platform and performing cleaning and data annotation using a large language model to obtain a labeled data set includes: Identify the collected data set according to the large language model and clean up format errors and redundant data; The labeling tool based on the large language model labels the cleaned collected data set, labels the preset financial and privacy information in the collected data set as a high-sensitivity data set, and labels the preset routine business information in the collected data set as a low-sensitivity data set. The role data set is obtained according to the user's department information. The high-sensitivity data set, low-sensitivity data set and role data set form a labeled data set, and the labeled data set is used to determine the user behavior type.

5. The user identity threat detection method based on a large language model according to claim 4, characterized in that: The step of parsing and extracting the labeled data set based on a cluster computing system and a large language model to obtain a feature data set includes: The labeled data set is based on a cluster computing system and a large language model to parse and extract the user's precise login time, longitude and latitude, device type, file name, file type, file operation type, change time and permission content and integrate them into a processed feature data set, which includes login features, operation features and permission features.

6. The user identity threat detection method based on a large language model according to claim 5, characterized in that: The method of converting the feature dataset into a high-dimensional semantic vector based on a word vector model, and inputting the high-dimensional semantic vector into a large language model to construct user behavior semantic association graph data, includes: Converting the user's operation features in the feature dataset into high-dimensional semantic vectors based on a word vector model; The high-dimensional semantic vector is input into the large language model, and the cosine similarity between different high-dimensional semantic vectors is calculated based on the semantic analysis of the large language model to construct a user behavior semantic association map.

7. The user identity threat detection method based on a large language model according to claim 6, characterized in that: The step of inputting the feature data set and the user behavior semantic association graph data into a large language model, wherein the large language model calculates threat probability data and generates a threat report, includes: Inputting the processed feature dataset and user behavior semantic association graph data into a large language model; If the feature data set and user behavior semantic association graph data trigger a preset abnormality threshold in the large language model, threat probability data is generated. The threat probability data is graded and classified into several levels by the large language model. The large language model generates a detailed threat report based on the graded and classified threat probability data. The threat report includes an external threat report of the network security data platform and an internal threat report of the enterprise's internal system. Generate warning information according to the threat report, and send the warning information based on an Internet message service, wherein the warning information includes threat time, location, user and resource information.

8. The user identity threat detection method based on a large language model according to claim 7, characterized in that: The real-time response mechanism preset initiating according to the threat report includes a response mechanism preset in the enterprise internal system and a response mechanism preset in the network security data platform, including: Initiating a response mechanism preset by the network security data platform based on the level classification and classification corresponding to the external threat report of the network security data platform in the threat report, wherein the response mechanism preset by the network security data platform includes freezing the relevant user account through the application programming interface of the identity authentication system; The level classification and classification corresponding to the internal threat report of the enterprise internal system in the threat report triggers a response mechanism preset in the enterprise internal system, wherein the response mechanism preset in the enterprise internal system includes an application programming interface of the rights management system to restrict access rights and retain preset rights; A detailed investigation process is initiated based on automated scripts to collect relevant operation logs and evidence.

9. The user identity threat detection method based on a large language model according to claim 8, characterized in that: The acquiring of historical event data and inputting it into the large language model, and adjusting the preset parameters and real-time response mechanism of the large language model, include: The historical event data includes successfully blocked threat event data and missed threat event data, and the preset parameters and real-time response mechanism of the large language model are adjusted according to the historical event data.

10. A user identity threat detection system based on a large language model, applied to the user identity threat detection method based on a large language model according to any one of claims 1 to 9, characterized in that: The system comprises: Establishing a training model module, wherein the training model module is used to establish a model based on an open source deep learning framework, obtain historical data set input and train the model to obtain a large language model; A data acquisition module, wherein the data acquisition module is used to customize and develop a data acquisition crawler based on a web crawler framework, deeply analyze the network security data platform according to the large language model, and obtain user identity threat intelligence data through the data acquisition crawler. The data acquisition crawler obtains multi-source user data from the enterprise's internal system, compresses the user identity threat intelligence data and the multi-source data to obtain a collection data set, imports the collected data set into the data processing platform, cleans and annotates the data through the large language model, and obtains a labeled data set; An extraction processing module, configured to parse and extract the labeled data set based on a cluster computing system and a large language model to obtain a feature data set; A conversion module, which is used to convert the feature data set into a high-dimensional semantic vector based on a word vector model, and input the high-dimensional semantic vector into a large language model to construct user behavior semantic association graph data; A calculation and generation module, the calculation and generation module is used to input the feature data set and the user behavior semantic association graph data into a large language model, the large language model calculates threat probability data and generates a threat report; A response module, the response module is used to initiate a preset real-time response mechanism according to the threat report, the real-time response mechanism including a response mechanism preset in the enterprise internal system and a response mechanism preset in the network security data platform; An adjustment module is used to obtain historical event data and input it into the large language model, and adjust the preset parameters and real-time response mechanism of the large language model.

Images