Large security model construction method and application for industrial internet security protection

Abstract

The invention relates to the technical field of large language models and network security, in particular to a security large model construction method and application for industrial internet security protection, and the method comprises the following steps: loading a base large model GLM-4, constructing a knowledge retrieval module, and accessing MITRE ATTamp; a CK knowledge base; the MITRE ATTamp; performing knowledge feature embedding vectorization on the safety knowledge in the CK knowledge base; establishing a vector database storage and retrieval module; a retrieval enhancement generation mechanism is started, and a test data set mitre-ttp-mapping is loaded; respectively constructing a local model and a comparison model, and carrying out a model comparison experiment; and evaluating the performance of the constructed security big model in a network security situation analysis task, evaluating the improvement effect of the model after applying a retrieval enhancement generation (RAG) mechanism, and outputting an RAG-based security big model scheme. The method and the device are suitable for security situation assessment in multiple scenes such as enterprises, industries and mobile scenes, and the accuracy and the interpretability of security content generation can be improved.

Description

Technical Field

[0001] The present application relates to the field of large language models and network security technology, and in particular to a method and application for constructing a large security model for industrial Internet security protection. Background Art

[0002] With the advancement of information technology, cybersecurity threats are becoming increasingly complex, and attackers' tactics, techniques, and procedures (TTPs) are constantly evolving. Traditional security defenses, such as rule-based intrusion detection systems (IDS) and signature-based antivirus software, often struggle to address emerging attack vectors, such as advanced persistent threats (APTs), zero-day exploits, and social engineering attacks. Therefore, improving security situational awareness, particularly the ability to accurately identify and analyze emerging attack techniques and tactics, has become a crucial research direction in the cybersecurity field.

[0003] In recent years, large-scale language models (LLMs) have made significant progress in the field of natural language processing (NLP) and have been gradually applied to network security scenarios such as security log analysis, malware detection, vulnerability assessment, and attack prediction. However, traditional LLMs are usually trained based on static data and have the following problems:

[0004] 1. Knowledge timeliness: Cybersecurity threats are constantly updated, but LLM’s pre-training data may be older and cannot contain the latest security threat intelligence.

[0005] 2. Hallucination problem: LLM may generate inaccurate or false security analysis content in the absence of external knowledge support, affecting the reliability of decision-making.

[0006] 3. Lack of specialized security knowledge: General LLMs are primarily trained based on internet data and have limited understanding and reasoning capabilities when faced with specialized security terminology or attack techniques and tactics.

[0007] While existing research has used large models for cybersecurity analysis, several issues remain. First, they are based on static knowledge. Existing LLMs often rely on fixed training data, making them difficult to adapt to the rapidly changing cybersecurity environment. Second, there is a disconnect between retrieval and generation. Traditional retrieval systems and text generation models are often independent, making efficient information fusion impossible. Third, there is a lack of targeted fine-tuning: Large models used in security applications often lack specialized fine-tuning strategies, limiting their reasoning capabilities. Summary of the Invention

[0008] The embodiments of the present application provide a method and application for constructing a large-scale security model for industrial Internet security protection. The method is suitable for security situation assessment in multiple scenarios such as enterprise, industry, and mobile, and can improve the accuracy and explainability of security content generation.

[0009] To solve the above technical problems, an embodiment of the present application provides a method for constructing a security big model for industrial Internet security protection, comprising the following steps: first, loading the base big model GLM-4, building a knowledge retrieval module, and accessing the MITRE ATT&CK knowledge base; then, embedding the security knowledge in the MITRE ATT&CK knowledge base into knowledge features and vectorizing them, using the BGE-M3 model to generate semantic embedding vectors to capture the deep semantic information of network security knowledge; next, building a vector database storage and retrieval module, using the FAISS vector database for efficient storage, and performing vector retrieval through cosine similarity calculation; then, starting the retrieval enhancement generation mechanism, the base big model GLM-4 dynamically introduces the ATT&CK knowledge in the field of network security when generating security content, and optimizes the context generation effect; next, loading the test data set mitre-ttp-mapping; constructing local models and comparison models respectively, conducting model comparison experiments, and performing model verification; finally, evaluating the performance of the constructed security big model in the network security situation analysis task, evaluating the improvement effect of the model after applying the retrieval enhancement generation (RAG) mechanism, and outputting a security big model construction solution based on the RAG mechanism.

[0010] In some exemplary embodiments, after outputting the RAG-based security big model construction plan, it also includes: adjusting the retrieval parameters to determine that the highest ATT&CK technical and tactical identification accuracy can be achieved when the number of relevant documents k is 20; comprehensively analyzing the experimental results, evaluating and outputting the final security big model construction plan, and achieving higher-quality security situation analysis and network attack technical and tactical identification in specialized security scenarios.

[0011] In some exemplary embodiments, the base large model GLM-4 is a domestically produced fourth-generation basic large model with 9 billion lightweight parameters, a lightweight architecture, and an integrated plug-in tool calling mechanism to support reasoning and analysis in complex security scenarios; the tool calling mechanism has built-in plug-in support, including: data query, code execution, knowledge base query, logical reasoning, and security reasoning optimization.

[0012] In some exemplary embodiments, the MITRE ATT&CK knowledge base covers three major scenarios: enterprise, industry, and mobile, and builds a security threat information index based on tactics, technology, and procedural data; the MITRE ATT&CK knowledge base has systematic network confrontation techniques, tactics, and procedural information, and supports security situation assessment in multiple scenarios.

[0013] In some exemplary embodiments, the attack scenarios covered by the MITRE ATT&CK knowledge base include enterprise environments, industrial control systems, and mobile devices; enterprise environments include IT network security threats; IT network security threats include phishing attacks, lateral movement, and data leakage; industrial control systems include security threats to industrial automation systems; security threats to industrial automation systems include sensor tampering and industrial protocol abuse; mobile devices cover attack techniques and tactics on iOS and Android devices, including malicious apps and data theft.

[0014] In some exemplary embodiments, the BGE-M3 model is used to convert natural language text into high-dimensional vectors, perform semantic embedding, and capture deep semantic relationships; the semantic embedding process is to preprocess the text of network attack techniques and tactics in the MITRE ATT&CK knowledge base; text preprocessing includes: using the BGE-M3 model to convert text into high-dimensional vectors. The conversion process can capture the similarities between attack techniques and tactics for subsequent vector retrieval.

[0015] In some exemplary embodiments, the vector database adopts the FAISS framework to support efficient vector storage and retrieval, and uses cosine similarity calculation for correlation matching; RAG combines information retrieval and text generation, and uses the RAG mechanism to contextually optimize the retrieved ATT&CK knowledge; the test dataset mitre-ttp-mapping contains real attack technique and tactic samples in different security scenarios, which is used to verify the accuracy of the large security model.

[0016] In some exemplary embodiments, a local model and a comparison model are constructed separately, including: directly using the base large model GLM-4 as the local model; the comparison model adopts the LoRAFT solution, and uses the ATT&CK knowledge base to fine-tune the LoRA instructions to verify the advantages of the dynamic retrieval enhancement generation mechanism in security situation analysis.

[0017] In some exemplary embodiments, a model comparison experiment is conducted, including: selecting mainstream large models GPT-4o, Claude3.5Sonnet or Gemini 1.5Flash for comparison in secure content generation to verify the advantages of the secure large models in the accuracy, explainability and coverage of generated content.

[0018] An embodiment of the present application also provides an application of the method for constructing a large security model for industrial Internet security protection described in the above embodiment in security situation assessment in an industrial Internet scenario.

[0019] The technical solution provided by the embodiments of the present application has at least the following advantages:

[0020] An embodiment of the present application provides a method and application for constructing a security big model for industrial Internet security protection. The method includes the following steps: first, loading the base big model GLM-4, building a knowledge retrieval module, and accessing the MITRE ATT&CK knowledge base; then, embedding the security knowledge in the MITRE ATT&CK knowledge base into knowledge features and vectorizing them, using the BGE-M3 model to generate semantic embedding vectors to capture the deep semantic information of network security knowledge; next, building a vector database storage and retrieval module, using the FAISS vector database for efficient storage, and performing vector retrieval through cosine similarity calculation; then, starting the retrieval enhancement generation mechanism, the base big model GLM-4 dynamically introduces the ATT&CK knowledge in the field of network security when generating security content, and optimizes the context generation effect; next, loading the test data set mitre-ttp-mapping; constructing a local model and a comparison model respectively, conducting a model comparison experiment, and performing model verification; finally, evaluating the performance of the constructed security big model in the network security situation analysis task, evaluating the improvement effect of the model after applying the RAG mechanism, and outputting a security big model construction plan based on the RAG mechanism.

[0021] Compared with the existing technology, this application combines the retrieval enhancement generation mechanism with a security field-specific knowledge base to dynamically introduce external security knowledge into the large model generation process, significantly reducing the model hallucination problem that may be caused by static fine-tuning; at the same time, it uses BGE-M3 for semantic embedding and the FAISS vector database for efficient retrieval, greatly improving the accuracy and response speed of security content generation. In particular, in the local model comparison scheme, by comparing the base large model GLM-4 and the LoRAFT scheme, the superior performance of this scheme in security situation analysis was verified; at the same time, through online model comparison experiments (including GPT-4o, Claude 3.5Sonnet, Gemini 1.5Flash), the specialized security large model of this application is superior to the existing online large model scheme in terms of the interpretability, coverage and comprehensive content quality of the generated results, thereby improving the overall security analysis and real-time defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] One or more embodiments are exemplarily described by pictures in the corresponding drawings. These exemplifications do not constitute limitations on the embodiments. Unless otherwise stated, the pictures in the drawings do not constitute proportional limitations.

[0023] Figure 1 A flowchart of a method for constructing a large security model for industrial Internet security protection provided in one embodiment of the present application.

[0024] Figure 2 A specific flow chart of a method for constructing a large security model for industrial Internet security protection provided in one embodiment of the present application.

[0025] Figure 3 A method and application diagram for building a large cloud-native search-enhanced generation model for industrial Internet security protection provided in one embodiment of the present application.

[0026] Figure 4 A schematic diagram of the result analysis of the local model provided in one embodiment of the present application.

[0027] Figure 5 This is an example comparison diagram of the local model provided in one embodiment of the present application.

[0028] Figure 6 This is an example comparison diagram of the online model provided in one embodiment of the present application. DETAILED DESCRIPTION

[0029] As can be seen from the background technology, traditional large-scale language models (LLMs) are usually trained based on static data, and have problems such as knowledge timeliness, hallucinations, and lack of specialized security knowledge.

[0030] To address the aforementioned issues with LLM in cybersecurity tasks, retrieval-augmented generation (RAG) technology has gained increasing attention in recent years. RAG is an architecture that combines information retrieval (retrieval) and text generation (generation). It can dynamically incorporate external knowledge during the generation process, improving the accuracy and interpretability of content. In cybersecurity scenarios, RAG's applications are mainly reflected in:

[0031] 1. Dynamically introduce security knowledge: By searching professional security knowledge bases such as MITRE ATT&CK, LLMs can improve their understanding of security techniques and tactics.

[0032] 2. Reduce hallucinations: Ensure that generated content is based on an authoritative security knowledge base rather than the model's own speculation, thereby improving the credibility of the generated content.

[0033] 3. Improve security situation analysis capabilities: Through knowledge enhancement, improve the performance of large models in APT attack detection, TTP identification and threat intelligence analysis.

[0034] Furthermore, MITRE ATT&CK is a globally recognized cybersecurity threat intelligence framework that systematically documents various attack techniques and tactics (TTPs) across enterprise, industrial control system (ICS), and mobile scenarios. This knowledge base is widely used in cybersecurity research and threat detection, providing authoritative data support for automated security analysis.

[0035] Although some studies have attempted to use large models for network security analysis, the following problems still exist:

[0036] 1. Based on static knowledge: Existing LLMs mostly rely on fixed training data and are difficult to adapt to the rapidly changing network security environment.

[0037] 2. Retrieval and generation are disconnected: Traditional retrieval systems and text generation models are often independent and cannot achieve efficient information fusion.

[0038] 3. Lack of targeted fine-tuning: The application of large models in the security field usually lacks professional fine-tuning strategies, which limits the reasoning ability.

[0039] In view of the complex security threats, evolving attack techniques and tactics, and illusion problems in the process of large-scale model generation in the current network security field, this application provides a method and application for building a large-scale security model for industrial Internet security protection, including the following steps: first, load the base large-scale model GLM-4, build a knowledge retrieval module, and access the MITRE ATT&CK knowledge base; then, The security knowledge in the ATT&CK knowledge base is embedded in the knowledge feature vectorization, and the BGE-M3 model is used to generate semantic embedding vectors to capture the deep semantic information of network security knowledge; next, a vector database storage and retrieval module is built, the FAISS vector database is used for efficient storage, and vector retrieval is performed through cosine similarity calculation; then, the retrieval enhancement generation mechanism is started, and the base large model GLM-4 dynamically introduces the ATT&CK knowledge in the field of network security when generating security content to optimize the context generation effect; next, the test data set mitre-ttp-mapping is loaded; local models and comparison models are constructed respectively, model comparison experiments are carried out, and model verification is performed; finally, the performance of the constructed security large model in the network security situation analysis task is evaluated, and the improvement effect of the model after applying the retrieval enhancement generation (RAG) mechanism is evaluated, and a security large model construction scheme based on the RAG mechanism is output. This application proposes a security large model construction scheme that dynamically introduces network security knowledge, takes into account efficient context generation and external knowledge correction. This scheme is suitable for security situation assessment in multiple scenarios such as enterprise, industry, and mobile, and can improve the accuracy and explainability of security content generation.

[0040] The following detailed description of the various embodiments of the present application is provided in conjunction with the accompanying drawings. However, those skilled in the art will appreciate that many technical details are provided in the various embodiments of the present application to facilitate a better understanding of the present application. However, even without these technical details and the various variations and modifications based on the following embodiments, the technical solutions claimed in the present application can still be implemented.

[0041] See Figure 1 , the embodiment of the present application provides a method for constructing a large security model for industrial Internet security protection, including the following steps:

[0042] Step S101: Load the large base model GLM-4, build a knowledge retrieval module, and access the MITRE ATT&CK knowledge base.

[0043] Step S102: embed and vectorize the security knowledge in the MITRE ATT&CK knowledge base using knowledge features, and use the BGE-M3 model to generate semantic embedding vectors to capture the deep semantic information of network security knowledge.

[0044] Step S103: Build a vector database storage and retrieval module, use the FAISS vector database for efficient storage, and perform vector retrieval through cosine similarity calculation.

[0045] Step S104: Start the Retrieval Enhanced Generation (RAG) mechanism. The base large model GLM-4 dynamically introduces ATT&CK knowledge in the field of network security when generating security content to optimize the context generation effect.

[0046] Step S105: Load the test dataset mitre-ttp-mapping; construct a local model and a comparison model respectively, conduct a model comparison experiment, and perform model verification.

[0047] Step S106: Evaluate the performance of the constructed security big model in the network security situation analysis task, evaluate the improvement effect of the model after applying the RAG mechanism, and output a security big model construction plan based on the RAG mechanism.

[0048] In some embodiments, after outputting the RAG-based security big model construction plan in step S106, it also includes: adjusting the retrieval parameters to determine that the highest ATT&CK technical and tactical recognition accuracy can be achieved when the number of relevant documents k is 20; comprehensively analyzing the experimental results, evaluating and outputting the final security big model construction plan, and achieving higher-quality security situation analysis and network attack technical and tactical recognition in specialized security scenarios.

[0049] In response to the complex security threats, evolving attack techniques and tactics, and hallucinations in the current cybersecurity landscape, this application provides a method for constructing a large security model for industrial Internet security protection. This method dynamically introduces cybersecurity knowledge, effectively generates context, and aligns with external knowledge correction. This solution is suitable for security situation assessment in multiple scenarios, including enterprise, industrial, and mobile, and can improve the accuracy and interpretability of security content generation. The specific implementation plan includes the following steps:

[0050] Step S0: Initialize the security big model construction task.

[0051] Step S1: Load the foundation large model (Foundation LLM) GLM-4. GLM-4 is a domestically produced fourth-generation large model with 9 billion lightweight parameters and an integrated tool calling mechanism.

[0052] Step S2: Build a knowledge retrieval module and access the MITRE ATT&CK knowledge base, which systematically records network adversarial techniques, tactics, and procedures (TTPs) and supports security situation assessment in multiple scenarios.

[0053] Step S3: Embed and vectorize the security knowledge in the MITRE ATT&CK knowledge base using knowledge features. Use the BGE-M3 model to generate semantic embedding vectors to capture the deep semantic information of cybersecurity knowledge and achieve high-quality knowledge representation.

[0054] Step S4: Build a vector database storage and retrieval module, use the FAISS vector database for efficient storage, and achieve fast and accurate vector retrieval through cosine similarity calculation.

[0055] Step S5: Start the Retrieval Enhanced Generation (RAG) mechanism. The base large model GLM-4 dynamically introduces ATT&CK knowledge in the field of network security when generating security content, optimizes the context generation effect, and effectively reduces the hallucination phenomenon caused by the large model.

[0056] Step S6: Load the test dataset mitre-ttp-mapping, which covers security attack pattern (TTP) information in enterprise, industrial and mobile user scenarios, and is used to verify the accuracy of security situation identification.

[0057] Step S7: Construct a local model comparison scheme, which includes: directly using the base large model GLM-4 as the local model (Scheme 1) and the LoRAFT scheme - using the ATT&CK knowledge base to fine-tune the LoRA instructions (Scheme 2) as comparison models to verify the advantages of the dynamic retrieval enhancement generation mechanism in security situation analysis.

[0058] Step S8: Conduct an online model comparison experiment, select mainstream large models such as GPT-4o, Claude 3.5Sonnet, and Gemini1.5Flash for comparison in secure content generation, and verify the advantages of this solution in the accuracy, interpretability, and coverage of generated content.

[0059] Step S9: Evaluate the performance of the constructed large security model (parameter quantity <10B) in the network security situation analysis task, evaluate the improvement effect of the model after applying the RAG mechanism, and the preliminary detection accuracy reaches more than 80%.

[0060] Step S10: By adjusting the search parameters, it is determined that the highest ATT&CK technique and tactic recognition accuracy (92.6%) can be achieved when the number of relevant documents k is 20.

[0061] Step S11: Integrate the experimental results, finally evaluate and output the RAG-based security large model construction plan, and achieve higher-quality security situation analysis and network attack technique and tactic identification in specialized security scenarios.

[0062] In some embodiments, the GLM-4 base model in step S1 is a domestically produced fourth-generation basic model with 9 billion lightweight parameters, a lightweight architecture, and an integrated plug-in tool calling mechanism to support reasoning and analysis in complex security scenarios. The GLM-4 base model uses an optimized version of the Transformer architecture, designed to provide natural language processing capabilities with low computational cost and strong reasoning capabilities.

[0063] The tool calling mechanism has built-in plug-in support: data query (calling databases or APIs), code execution (executing Python, SQL, and other codes), knowledge base query (searching ATT&CK or other databases), logical reasoning (security analysis based on external knowledge), and security reasoning optimization (in network security scenarios, GLM-4 dynamically accesses the security knowledge base through a plug-in mechanism to improve the accuracy of security content and ensure that reasoning is based on trusted data sources).

[0064] In some embodiments, the MITRE ATT&CK knowledge base in step S2 covers three scenarios: enterprise, industrial, and mobile. It constructs a security threat information index based on tactics, techniques, and procedures (TTPs). The MITRE ATT&CK knowledge base contains systematic cyberattack tactics and procedures information, supporting security posture assessments in multiple scenarios. MITRE ATT&CK is a globally recognized cybersecurity threat intelligence framework that systematically documents cyberattack tactics, techniques, and procedures (TTPs).

[0065] In some embodiments, the attack scenarios covered by the MITRE ATT&CK knowledge base in step S102 include enterprise environments (Enterprise ATT&CK), industrial control systems (ICS ATT&CK), and mobile devices (Mobile ATT&CK); enterprise environments include IT network security threats; IT network security threats include phishing attacks, lateral movement, and data leakage; industrial control systems include security threats to industrial automation systems; security threats to industrial automation systems include sensor tampering and industrial protocol abuse; mobile devices cover attack techniques and tactics on iOS and Android devices, including malicious apps and data theft.

[0066] It's important to note that the TTPs in the knowledge base are stored as structured data, including: Tactics: attacker intent, such as "Initial Access"; Techniques: specific attack methods, such as "Phishing"; and Procedures: the actual steps an attacker takes, such as "Sending a malicious attachment via email." This data is pre-processed into an efficient index for fast query and retrieval enhancement (RAG).

[0067] Since most of the data in the knowledge base is often very lengthy, directly searching these large amounts of text can easily lead to information overload, slowing down the running speed of the generated model and failing to accurately match the relevant information of the user's query. To solve this problem, it is necessary to use document segmentation technology to divide long texts into smaller, more easily processed logical units. Each segmented fragment remains independent in context, which not only effectively improves processing efficiency, but also enables more accurate information retrieval and relevance matching. The segmented small pieces of knowledge can be directly connected to the user's input prompt to provide more relevant knowledge. This project adopts a recursive character segmentation strategy, as shown below:

[0068]

[0069] in represents the original document, L represents the character threshold, S i Indicates segmentation. When segment S i When the context independence of is insufficient, it can be further divided recursively:

[0070] S i ={s i1 ,s i2 ,...,s im},where|s ij |≤L',1≤j≤m

[0071] In addition, this application also uses a keyword extraction algorithm (TF-IDF) to extract the fragment S i The keyword set {k1, k2, ..., k q}, as shown below:

[0072]

[0073] Where TF(t,S i ) is the term t in segment S iDF(t) is the probability of term t appearing in the entire battlefield knowledge base, and N is the total number of documents in the battlefield knowledge base. Based on the extracted keywords, the classification information C = {k j :k j ∈Relevant Keywords for User Prompt}, which facilitates filtering irrelevant contexts during retrieval.

[0074] In some embodiments, in step S3, the knowledge feature embedding vectorization uses the BGE-M3 model to generate high-quality semantic embedding vectors that capture the deep semantic features of cybersecurity knowledge. The BGE-M3 (BAAI General Embedding Model M3) is a leading domestic text embedding model specifically designed for learning high-quality semantic representations. The BGE-M3 model is used to convert natural language text into high-dimensional vectors for semantic embedding and capture deep semantic relationships.

[0075] The process of semantic embedding is to pre-process the text of network attack techniques and tactics (TTPs) in the MITRE ATT&CK knowledge base. For example: "Phishing is a social engineering attack method that usually obtains user credentials through deceptive emails." Use the BGE-M3 model to convert the above text into a high-dimensional vector, such as: [-0.23, 0.78, -0.45, ...] (vector dimension 1024). This vectorization process can capture the similarity between attack techniques and tactics, facilitating subsequent vector retrieval. In the above process, a pre-trained embedding model is used to convert each text segment into a point in a vector space, so that segments with high semantic similarity are closer in the vector space, that is, Where f represents the embedding model, v i It's S i is the vector representation of , and d is the dimension of the vector space.

[0076] In some embodiments, the vector database in step S4 uses the FAISS framework to support efficient vector storage and retrieval, and uses cosine similarity calculation for correlation matching. FAISS (Facebook AI Similarity Search) is an industry-leading efficient vector retrieval library that can efficiently store and search very large-scale vector data. Similarity calculation in vector space is performed using cosine similarity as shown below:

[0077]

[0078] Where ||·|| is the Euclidean norm of the vector. When searching through the vector database, for all stored vectors v iCalculate its difference with the query vector v q The similarity score of the most relevant fragments is selected based on the preset threshold or sorting results:

[0079]

[0080] The matching system returns the knowledge content most relevant to the query, and this information is introduced into the subsequent generation stage.

[0081] In step S5, the RAG mechanism performs context optimization based on the retrieved ATT&CK knowledge during the security content generation process to reduce the hallucination phenomenon generated by large models and improve the credibility of security content, such as Figure 3 As shown in Figure 2, RAG (Retrieval-Augmented Generation) combines information retrieval (retrieval) and text generation (generation). Retrieval refers to searching the ATT&CK knowledge base for relevant attack techniques and tactics, while generation involves the large-scale base model GLM-4 generating responses based on the retrieved information. This mechanism ensures that generated content is based on authoritative knowledge, preventing the model from "fabricating" content (a problem known as hallucination).

[0082] The test dataset mitre-ttp-mapping in step S6 contains samples of real-world attack techniques and tactics (TTPs) from various security scenarios, used to verify the accuracy of the security model. This dataset covers enterprise, industrial, and mobile security attack samples. This dataset is used to test the security model's TTP recognition accuracy and ensure its reliability in real-world applications.

[0083] In some embodiments, in step S7, a local model and a comparison model are constructed respectively, including: directly using the base large model GLM-4 as the local model; the comparison model adopts the LoRAFT solution, and uses the ATT&CK knowledge base to fine-tune the LoRA instructions to verify the advantages of the dynamic retrieval enhancement generation mechanism in security situation analysis.

[0084] Specifically, the local model comparison schemes include: directly using the base large model GLM-4 (Scheme 1) and the LoRA instruction fine-tuning scheme based on the ATT&CK knowledge base - LoRAFT (Scheme 2).

[0085] Solution 1 directly uses GLM-4 (90B parameters) for security situation analysis without additional knowledge enhancement or fine-tuning. This solution relies on GLM-4's pre-trained knowledge for reasoning, but may have the following issues: Because GLM-4 training data does not cover the latest security threat intelligence, it may lead to missing or outdated knowledge; and it may produce hallucinations (i.e., incorrect generation) when processing professional security terminology or MITRE ATT&CK techniques and tactics.

[0086] Solution 2: LoRA fine-tuning based on the ATT&CK knowledge base. LoRA (Low-Rank Adaptation) is a lightweight fine-tuning method. This method adds a low-rank matrix (LoRA layer) to the pre-trained model, allowing fine-tuning without changing the original weights. The computational cost of this method is much lower than full parameter fine-tuning.

[0087] The specific optimization steps for LoRA fine-tuning are as follows: first, common attack techniques and tactics (TTPs) are extracted from the MITRE ATT&CK knowledge base to construct a training set; then, based on instruction learning (Instruction Tuning), TTP recognition tasks are used for fine-tuning to make GLM-4 better at answering security-related questions. LoRA fine-tuning reduces the parameter adjustment range and improves training efficiency.

[0088] In some embodiments, a model comparison experiment is conducted in step S8, including: selecting mainstream large models GPT-4o, Claude 3.5Sonnet or Gemini 1.5Flash for comparison in secure content generation to verify the advantages of the secure large models in the accuracy, interpretability and coverage of generated content.

[0089] In step S10, by adjusting the search parameters, such as Figure 4 As shown in the figure, it is determined that as the number of relevant documents increases, the accuracy of ATT&CK technique and tactic recognition also increases, and at the same time the response delay of the large model also increases. When the number of relevant documents k = 20, the highest ATT&CK technique and tactic recognition accuracy (92.6%) can be achieved.

[0090] In step S11, the experimental results are integrated to finally evaluate and output a RAG-based security big model construction plan to achieve higher-quality security situation analysis and network attack technique and tactic identification in specialized security scenarios.

[0091] Compared with the existing technology, this application combines the Retrieval Enhanced Generation (RAG) mechanism with a security domain-specific knowledge base to dynamically introduce external security knowledge into the large model generation process, significantly reducing the model hallucination problem that may be caused by static fine-tuning; at the same time, it uses BGE-M3 for semantic embedding and FAISS vector database for efficient retrieval, which greatly improves the accuracy and response speed of security content generation. Especially in the local model comparison scheme, such as Figure 5 As shown in the figure, by comparing the large-scale base model GLM-4 with the LoRAFT scheme, the superior performance of this scheme in security situation analysis is verified; at the same time, Figure 6 As shown in the online model comparison experiments (including GPT-4o, Claude 3.5Sonnet, and Gemini 1.5Flash), the specialized security big model of the present invention is superior to the existing online big model solutions in terms of the interpretability, coverage, and comprehensive content quality of the generated results, thereby improving the overall security analysis and real-time defense capabilities.

[0092] An embodiment of the present application also provides an application of the method for constructing a large security model for industrial Internet security protection described in the above embodiment in security situation assessment in an industrial Internet scenario.

[0093] Based on the above technical solution, the embodiment of the present application provides a method and application for constructing a security big model for industrial Internet security protection. The method includes the following steps: first, loading the base big model GLM-4, building a knowledge retrieval module, and accessing the MITRE ATT&CK knowledge base; then, the security knowledge in the MITRE ATT&CK knowledge base is embedded and vectorized, and the BGE-M3 model is used to generate semantic embedding vectors to capture the deep semantic information of network security knowledge; next, a vector database storage and retrieval module is built, the FAISS vector database is used for efficient storage, and vector retrieval is performed through cosine similarity calculation; then, the retrieval enhancement generation mechanism is started, and the base big model GLM-4 dynamically introduces the ATT&CK knowledge in the field of network security when generating security content to optimize the context generation effect; next, the test data set mitre-ttp-mapping is loaded; local models and comparison models are constructed respectively, model comparison experiments are carried out, and model verification is performed; finally, the performance of the constructed security big model in the network security situation analysis task is evaluated, the improvement effect of the model after the application of the RAG mechanism is evaluated, and a security big model construction solution based on the RAG mechanism is output.

[0094] Those skilled in the art will appreciate that the above-described embodiments are specific examples for implementing the present application, and that in actual applications, various changes in form and detail may be made thereto without departing from the spirit and scope of the present application. Any person skilled in the art may make changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined in the claims.

Claims

1. A method for constructing a large security model for industrial Internet security protection, characterized in that: The following steps are involved: Load the large base model GLM-4, build a knowledge retrieval module, and access the MITRE ATT&CK knowledge base; The security knowledge in the MITRE ATT&CK knowledge base is embedded and vectorized using the BGE-M3 model to generate semantic embedding vectors to capture the deep semantic information of cybersecurity knowledge. Build a vector database storage and retrieval module, use the FAISS vector database for efficient storage, and perform vector retrieval through cosine similarity calculation; The search-enhanced generation mechanism is activated. The large base model GLM-4 dynamically introduces ATT&CK knowledge in the field of network security when generating security content, optimizing the context generation effect. Load the test dataset mitre-ttp-mapping; build a local model and a comparison model, conduct model comparison experiments, and perform model verification; Evaluate the performance of the constructed big security model in the network security situation analysis task, evaluate the improvement effect of the model after applying the retrieval enhancement generation mechanism, and output the construction plan of the big security model based on the retrieval enhancement generation mechanism.

2. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: After outputting the RAG-based large-scale security model construction plan, it also includes: By adjusting the search parameters, we determined that the highest ATT&CK technique and tactic recognition accuracy can be achieved when the number of relevant documents k is 20; Based on the experimental results, the final security model construction plan is evaluated and output to achieve higher-quality security situation analysis and identification of network attack techniques and tactics in specialized security scenarios.

3. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: The base large model GLM-4 is a domestically produced fourth-generation basic large model with 9 billion lightweight parameters, a lightweight architecture, and an integrated plug-in tool calling mechanism to support reasoning and analysis in complex security scenarios. The tool calling mechanism has built-in plug-in support, including: data query, code execution, knowledge base query, logical reasoning and security reasoning optimization.

4. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: The MITRE ATT&CK knowledge base covers three scenarios: enterprise, industrial, and mobile, and builds a security threat information index based on tactics, techniques, and procedural data; The MITRE ATT&CK knowledge base contains systematic cyber adversarial techniques, tactics, and procedural information, supporting security situation assessment in multiple scenarios.

5. The method for constructing a large security model for industrial Internet security protection according to claim 4 is characterized in that: The attack scenarios covered by the MITRE ATT&CK knowledge base include enterprise environments, industrial control systems, and mobile devices; Enterprise environments include IT cybersecurity threats; IT cybersecurity threats include phishing attacks, lateral movement, and data leakage; Industrial control systems include security threats to industrial automation systems; security threats to industrial automation systems include sensor tampering and industrial protocol abuse; Mobile devices cover attack techniques and tactics on iOS and Android devices, including malicious apps and data theft.

6. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: The BGE-M3 model is used to convert natural language text into high-dimensional vectors for semantic embedding and capture deep semantic relationships. The process of semantic embedding is to pre-process the text of cyber attack techniques and tactics in the MITRE ATT&CK knowledge base; The text preprocessing includes: using the BGE-M3 model to convert the text into a high-dimensional vector. The conversion process can capture the similarities between attack techniques and tactics for subsequent vector retrieval.

7. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: The vector database adopts the FAISS framework to support efficient vector storage and retrieval, and uses cosine similarity calculation for correlation matching; The retrieval-enhanced generation mechanism combines information retrieval and text generation, and uses the retrieval-enhanced generation mechanism to contextually optimize the retrieved ATT&CK knowledge. The test dataset mitre-ttp-mapping contains samples of real attack techniques and tactics in different security scenarios, which is used to verify the accuracy of the security model.

8. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: Build local models and comparison models separately, including: Directly use the large base model GLM-4 as the local model; The comparison model adopts the LoRAFT solution and uses the ATT&CK knowledge base to fine-tune the LoRA instructions to verify the advantages of the dynamic retrieval enhancement generation mechanism in security situation analysis.

9. The method for constructing a large security model for industrial Internet security protection according to claim 1 is characterized in that: Conduct model comparison experiments, including: We selected mainstream large models GPT-4o, Claude 3.5Sonnet, or Gemini 1.5Flash for comparison in secure content generation to verify the advantages of secure large models in the accuracy, explainability, and coverage of generated content.

10. An application of the method for constructing a large security model for industrial Internet security protection as described in any one of claims 1 to 9 in security situation assessment in an industrial Internet scenario.

Images