Network protocol stack cross-layer interactive security analysis method based on large language model

Abstract

The invention discloses a network protocol stack cross-layer interactive security analysis method based on a large language model. According to the method, automatic detection and analysis of protocol stack cross-layer security vulnerabilities are realized through information interaction between intelligent agent systems Agents. Wherein the dialogue Agent is responsible for processing user input and performing interactive feedback; the vulnerability analysis Agent decomposes an analysis task into sub-tasks and coordinates other Agents to obtain information; the document analysis Agent analyzes the protocol document and generates a structured representation; and the retrieval Agent executes multiple rounds of retrieval in the vector database to obtain related information. According to the method, the limitation of a traditional protocol stack security analysis method in cross-layer interaction analysis is broken through, a complex cross-layer interaction process between protocols can be automatically analyzed, a multi-source protocol specification document and an implementation code are comprehensively processed, potential cross-layer interaction security vulnerabilities in a protocol stack are systematically detected and identified, and the security of the protocol stack is improved. And the overall security and the analysis efficiency of the protocol stack are obviously improved.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, in particular to a network protocol stack cross-layer interactive security analysis method based on a large language model. Background Art

[0002] Network protocol specifications, the foundation for the secure and stable operation of modern cyberspace, define standardized information exchange mechanisms between network devices. To effectively manage system complexity, the protocol stack adopts a layered architecture, such as the typical OSI seven-layer model and the TCP / IP four-layer model. Each layer has a clearly defined functional boundary: the link layer is responsible for underlying data frame transmission, the network layer performs routing and forwarding, the transport layer implements reliable transmission and flow control, and the application layer provides user-facing network service interfaces. This layered architecture design, continuously optimized over decades, has played a significant role in enhancing the security and reliability of network communications.

[0003] However, in actual data transmission, protocol layers are tightly coupled. For example, in a typical file transfer scenario, the FTP protocol requires establishing both control and data connections, a process that involves the coordination of multiple layers of protocols, including TCP connection management, IP routing, and ARP address resolution. Another example is real-time multimedia communication, where the RTP protocol handles media streaming, the RTCP protocol performs transmission control, and the UDP protocol provides basic transmission services. NAT traversal is also implemented using protocols like STUN and TURN. While this cross-layer interaction is unavoidable, it introduces potential security risks. Even if individual protocol layers meet high security standards, the security features of these layers can still interfere with each other during interaction. Specifically, security mechanisms implemented in one layer can be bypassed by routine operations in other layers, compromising the overall security of the protocol stack.

[0004] Current protocol stack security analysis methods can be broadly categorized into several technical approaches, including formal verification, fuzz testing, symbolic execution, and expert experience. Formal verification methods offer significant advantages in terms of the reliability of analysis results by constructing precise mathematical models of protocols and applying rigorous mathematical tools such as theorem proofs to verify security properties. However, their complex modeling process limits their practical application in large-scale systems. Fuzz testing methods employ a strategy of constructing anomalous inputs, injecting various edge cases and abnormal data into protocol implementations to trigger potential vulnerabilities. This approach is relatively easy to implement and easily automated, but due to the lack of a systematic test case generation mechanism, it can easily miss logical vulnerabilities that require specific conditions to trigger. Symbolic execution technology offers advantages in vulnerability coverage by simulating program execution and analyzing all possible execution paths. However, it often faces computational complexity challenges, such as path explosion, when dealing with complex protocol interactions. While these existing approaches each have their own unique advantages and play an important role in specific scenarios, they remain insufficient when addressing the complex challenge of cross-layer security analysis in protocol stacks. The primary problem is the difficulty in fully capturing and analyzing the complexity of inter-layer interactions: diverse state dependencies and data interaction patterns exist between protocol layers. Traditional methods often limit analysis to a single protocol level, making it impossible to effectively model and verify the security properties of cross-layer interaction scenarios. Secondly, due to a lack of in-depth understanding of protocol specification documents and the ability to extract semantics, existing tools struggle to accurately grasp the core intent and security assumptions of protocol design, resulting in analysis results that may deviate from the security requirements of the protocol itself. More importantly, in practical applications, these methods often require a significant amount of expert resources for manual development and result verification, which is not only inefficient but also difficult to adapt to the growing demand for protocol stack analysis. These inherent limitations severely restrict the practical application value of existing methods in cross-layer security analysis of protocol stacks.

[0005] With the rapid development of Large Language Model (LLM) technology, these models have demonstrated exceptional natural language understanding and in-depth code analysis capabilities. Intelligent agent systems (Agents) built on LLMs can precisely invoke relevant tools based on user instructions to obtain information, breaking down complex tasks into manageable subtask sequences. Through continuous logical reasoning and status updates, they ultimately provide users with systematic solutions. Summary of the Invention

[0006] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0007] The present invention proposes a cross-layer interactive security analysis method for network protocol stacks based on a large language model, which is conducive to the automated mining and verification of cross-layer interactive vulnerabilities in network protocols.

[0008] Another object of the present invention is to propose a cross-layer interactive security analysis device for a network protocol stack based on a large language model.

[0009] To achieve the above objectives, the present invention proposes a cross-layer interactive security analysis method for a network protocol stack based on a large language model, comprising:

[0010] The conversational intelligent agent system intelligently associates and completes the user's request information to determine the vulnerability analysis requirements, and determines the vulnerability analysis task based on the vulnerability analysis intelligent agent system's analysis data of the vulnerability analysis requirements;

[0011] The vulnerability analysis intelligent agent system uses the thought chain technology to decompose the vulnerability analysis task into multiple subtask units according to the vulnerability analysis requirements, and calls other intelligent agent systems to obtain the required information to analyze and process cross-layer interaction vulnerabilities and output analysis results;

[0012] The document analysis intelligent agent system receives document parsing requests initiated by some of the multiple subtask units to parse the input protocol document and generate a structured data representation; wherein the structured data representation is stored in a pre-built vector database;

[0013] The retrieval intelligent agent system performs generative multi-round retrieval operations in a pre-built vector database to obtain complete information corresponding to the query content, and feeds back the retrieved structured complete information to the analysis intelligent agent system and the dialogue intelligent agent system.

[0014] The network protocol stack cross-layer interactive security analysis method based on a large language model according to an embodiment of the present invention may also have the following additional technical features:

[0015] In one embodiment of the present invention, the conversational intelligent agent system performs intelligent association completion on the user request information to determine the vulnerability analysis requirements, and determines the vulnerability analysis task based on the analysis data of the vulnerability analysis requirements by the vulnerability analysis intelligent agent system, including:

[0016] The conversational intelligent agent system receives and processes user request information; and conducts coherent multi-round conversations with the user by tracking the conversation history and context state;

[0017] Perform intelligent association completion on the user request information to obtain the user's vulnerability analysis requirements, and store the vulnerability analysis requirements in a preset shared memory;

[0018] Based on the analysis process information and result data of the vulnerability analysis intelligent agent system in the shared memory, the execution process and analysis conclusion of the vulnerability analysis are fed back to the user.

[0019] In one embodiment of the present invention, the intelligent associative completion is based on a preset large language model, and the instructions are fine-tuned by constructing a prompt template that contains professional knowledge of protocol stack security analysis. The prompt template includes system role definition, analysis requirement description and supplementary information acquisition; the analysis conclusion is presented in a hierarchical visual manner, including a hierarchical display of the protocol stack of vulnerability location information, a quantitative indicator display of the risk level and a priority ranking of repair suggestions.

[0020] In one embodiment of the present invention, the vulnerability analysis intelligent agent system uses thought chain technology to decompose the vulnerability analysis task into multiple subtask units according to vulnerability analysis requirements, and calls other intelligent agent systems to obtain required information to analyze and process cross-layer interaction vulnerabilities and output analysis results, including:

[0021] Decompose vulnerability analysis tasks into multiple subtask units according to vulnerability analysis requirements;

[0022] For each subtask, a hybrid retrieval strategy based on keywords and semantic vectors is used to filter out relevant document information from a large number of documents;

[0023] Use a large language model to extract key document information from related document information;

[0024] Use abstract syntax trees and symbolic execution techniques to locate and extract key code information for each subtask;

[0025] The collected key document information and key code information are analyzed using the preset security analysis method, and intermediate reasoning is performed through the constructed reasoning template, preset prompt word triggers and verification mechanism to generate the final vulnerability analysis results.

[0026] In one embodiment of the present invention, the document analysis intelligent agent system receives document parsing requests initiated by some of the multiple subtask units to parse the input protocol document and generate a structured data representation, including:

[0027] Receive document parsing requests initiated by some task units, use named entity recognition technology to extract protocol-related entities from the input protocol document, and use dependency syntax to analyze the relationship between entities to obtain parsing results;

[0028] Build a message interaction model based on temporal logic based on the extracted entities and the relationships between them to obtain the modeling results;

[0029] The parsing results and modeling results are converted into a unified JSON format document. The generated JSON format document is used for data sharing and query across intelligent agent systems.

[0030] In one embodiment of the present invention, the retrieval intelligent agent system performs a generative multi-round retrieval operation in a pre-built vector database to obtain complete information corresponding to the query content, and feeds the retrieved structured complete information back to the analysis intelligent agent system and the conversational intelligent agent system, including:

[0031] The cosine similarity metric is used to calculate the similarity between document vectors, and the TF-IDF weighting strategy is combined to improve the retrieval weight of key information to output document fragments;

[0032] Use a large language model to process document fragments to generate text embedding representations, and use an attention mechanism to capture contextual semantic associations and output the generated text embedding representations after deep semantic matching;

[0033] The text embeddings generated after deep semantic matching are subjected to a multi-round retrieval process, including initial retrieval, result reranking, and query rewriting, to output an optimized list of candidate documents. Initial retrieval generates an initial query vector based on the input, result reranking optimizes the ranking based on relevance scores, and query rewriting dynamically adjusts the retrieval strategy based on user feedback.

[0034] The optimized candidate document list is combined with the source, timestamp, and credibility to obtain structured complete information, and the structured complete information is used as input data for the analytical intelligent agent system and reference data for the conversational intelligent agent system during human-computer interaction.

[0035] To achieve the above-mentioned object, the present invention further proposes a cross-layer interactive security analysis device for a network protocol stack based on a large language model, comprising:

[0036] A conversational intelligent agent system is used to intelligently associate and complete user request information to determine vulnerability analysis requirements, and determine vulnerability analysis tasks based on the analysis data of the vulnerability analysis requirements by the vulnerability analysis intelligent agent system;

[0037] Vulnerability analysis intelligent agent system, which is used to decompose vulnerability analysis tasks into multiple subtask units based on vulnerability analysis requirements using thought chain technology, and call other intelligent agent systems to obtain the required information to analyze and process cross-layer interaction vulnerabilities and output analysis results;

[0038] a document analysis intelligent agent system, configured to receive document parsing requests initiated by some of the plurality of subtask units, to parse the input protocol document and generate a structured data representation; wherein the structured data representation is stored in a pre-built vector database;

[0039] The retrieval intelligent agent system is used to perform generative multi-round retrieval operations in a pre-built vector database to obtain complete information corresponding to the query content, and feed back the retrieved structured complete information to the analysis intelligent agent system and the dialogue intelligent agent system.

[0040] The large language model-based cross-layer interactive security analysis method and apparatus for network protocol stacks in this embodiment of the present invention addresses the challenge of cross-layer security analysis in protocol stacks by pioneering an automated analysis framework based on LLM agents. This framework can autonomously analyze complex cross-layer interaction flows between protocols, comprehensively process multi-source protocol specification documents and their corresponding implementation code, and systematically detect and identify potential cross-layer interaction security vulnerabilities in the protocol stack, thereby significantly improving the overall security and robustness of the protocol stack.

[0041] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0043] Figure 1 is a structural diagram of a network protocol stack cross-layer interactive security analysis method based on a large language model according to an embodiment of the present invention;

[0044] Figure 2 1 is an architectural diagram of a cross-layer interactive security analysis method for a network protocol stack based on a large language model according to an embodiment of the present invention;

[0045] Figure 3 2 is a structural diagram of a network protocol stack cross-layer interactive security analysis device based on a large language model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0047] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0048] The following describes a method and apparatus for cross-layer interactive security analysis of a network protocol stack based on a large language model according to an embodiment of the present invention with reference to the accompanying drawings.

[0049] The present invention proposes a network protocol stack cross-layer interactive security analysis architecture based on a large language model (LLM) agent. Figure 1 As shown in the figure, this architecture comprises a multi-agent collaborative analysis framework, including a dialogue agent, a vulnerability analysis agent, a document analysis agent, and a retrieval agent. Through information exchange between agents, it enables automated detection and analysis of cross-layer security vulnerabilities in the protocol stack. The dialogue agent is responsible for processing user input and providing interactive feedback; the vulnerability analysis agent decomposes the analysis task into subtasks and coordinates other agents to obtain information; the document analysis agent parses the protocol document and generates a structured representation; and the retrieval agent performs multiple rounds of searches in the vector database to obtain relevant information. This method overcomes the limitations of traditional protocol stack security analysis methods in cross-layer interaction analysis. It can automatically analyze complex cross-layer interaction processes between protocols, comprehensively process multi-source protocol specification documents and implementation code, and systematically detect and identify potential cross-layer interaction security vulnerabilities in the protocol stack, significantly improving the overall security and analysis efficiency of the protocol stack. The method implemented through this architecture can effectively address the increasingly complex cross-layer security analysis needs of network protocol stacks.

[0050] Figure 2 is a flow chart of a cross-layer interactive security analysis method for a network protocol stack based on a large language model according to an embodiment of the present invention. Figure 2 As shown, the method includes:

[0051] S1, the conversational intelligent agent system performs intelligent association completion on the user's request information to determine the vulnerability analysis requirements, and determines the vulnerability analysis task based on the analysis data of the vulnerability analysis requirements by the vulnerability analysis intelligent agent system.

[0052] It can be understood that the dialogue agent processes user requests in a fast-thinking mode and stores vulnerability analysis requirements in a shared memory, and interacts with the user based on the analysis results in the shared memory.

[0053] Specifically, the dialogue agent receives and processes the request information input by the user, interacts with the user through a coherent human-computer dialogue, performs intelligent association completion on the user input, extracts and clarifies the user's vulnerability analysis requirements, and stores the requirements in the preset shared memory; based on the analysis process information and result data of the vulnerability analysis agent in the shared memory, it provides feedback to the user on the execution process and analysis conclusions of the vulnerability analysis.

[0054] In one embodiment of the present invention, intelligent associative completion is based on GPT-4 or a similar large language model, and instruction fine-tuning is performed by constructing a prompt template that contains professional knowledge of protocol stack security analysis. The prompt template includes multiple components such as system role definition, analysis requirement description, and supplementary information acquisition.

[0055] In one embodiment of the present invention, a coherent multi-turn dialogue is achieved by tracking the dialogue history and context status.

[0056] In one embodiment of the present invention, the analysis conclusion is presented in a hierarchical visualization manner, including a hierarchical display of the protocol stack of vulnerability location information, a quantitative indicator display of the risk level, and a priority ranking of repair suggestions.

[0057] S2, the vulnerability analysis intelligent agent system uses the thinking chain technology to decompose the vulnerability analysis task into multiple sub-task units according to the vulnerability analysis requirements, and calls other intelligent agent systems to obtain the required information to analyze and process cross-layer interaction vulnerabilities and output analysis results.

[0058] It can be understood that the vulnerability analysis agent decomposes the analysis requirements into subtasks and calls other agents to obtain information, performs cross-layer interactive vulnerability analysis, and outputs the results.

[0059] Specifically, the vulnerability analysis agent decomposes the vulnerability analysis task into multiple subtask units according to the user's analysis requirements, calls other agents to obtain the required information, completes the analysis and processing of cross-layer interaction vulnerabilities, and outputs the analysis results.

[0060] In one embodiment of the present invention, the thinking chain technology constructs a specific reasoning template, including four key steps: problem decomposition, information collection, intermediate reasoning and conclusion generation; each step sets a corresponding prompt word trigger and verification mechanism; document retrieval adopts a hybrid retrieval strategy based on keywords and semantic vectors; document analysis extracts key information based on a large language model; code retrieval uses abstract syntax trees and symbolic execution technology; code analysis integrates security analysis methods such as data flow analysis and taint analysis, and identifies potential vulnerabilities by analyzing the implementation of security mechanisms such as integrity verification and boundary checking during cross-layer data transmission.

[0061] The embodiment of the present invention decomposes the vulnerability analysis task into multiple subtask units according to the vulnerability analysis requirements; for each subtask, a hybrid retrieval strategy based on keywords and semantic vectors is used to screen out relevant document information from a large number of documents; a large language model is used to extract key document information from the relevant document information; an abstract syntax tree and symbolic execution technology are used to locate and extract the key code information of each subtask; a preset security analysis method is used to analyze the collected key document information and key code information, and intermediate reasoning is performed through the constructed reasoning template, preset prompt word trigger and verification mechanism to generate the final vulnerability analysis result.

[0062] S3, the document analysis intelligent agent system receives document parsing requests initiated by some task units among the multiple subtask units to parse the input protocol document and generate a structured data representation; wherein the structured data representation is stored in a pre-built vector database.

[0063] It can be understood that the document analysis agent parses the input document and generates a structured data representation.

[0064] In one embodiment of the present invention, the document analysis agent uses natural language processing technology to parse the document structure, including using named entity recognition to extract protocol-related entities and using dependency syntax analysis to understand the relationship between entities; constructing a message interaction model based on temporal logic, including elements such as message type, parameter definition, and state transition; the JSON format document adopts a unified schema definition, including fields such as protocol identifier, function description, interface definition, and state machine description, supporting cross-agent data sharing and query.

[0065] An embodiment of the present invention receives a document parsing request initiated by some task units, uses named entity recognition technology to extract protocol-related entities from the input protocol document, and uses dependency syntax to analyze the relationship between entities to obtain a parsing result; constructs a message interaction model based on temporal logic according to the extracted entities and the relationship between entities to obtain a modeling result; converts the parsing result and the modeling result into a unified JSON format document, and the generated JSON format document is used for data sharing and query across intelligent agent systems.

[0066] S4, the retrieval intelligent agent system performs generative multi-round retrieval operations in the pre-built vector database to obtain complete information corresponding to the query content, and feeds back the retrieved structured complete information to the analysis intelligent agent system and the dialogue intelligent agent system.

[0067] It can be understood that the retrieval agent performs generative multi-round retrieval operations in the pre-built vector database to obtain complete information corresponding to the query content.

[0068] In one embodiment of the present invention, the retrieval process is executed according to the following logic: first, the cosine similarity metric is used to calculate vector similarity, and the TF-IDF weighting strategy is combined to improve the retrieval weight of key information; second, a text embedding representation is generated based on a large language model, and the contextual semantic association is captured through the attention mechanism to achieve deep semantic matching; third, a multi-round retrieval process including initial retrieval, result reranking, and query rewriting is executed, wherein the initial retrieval generates an initial query vector based on user input, the result reranking is optimized according to the relevance score, and the query rewriting dynamically adjusts the retrieval strategy based on user feedback information; finally, the retrieved content information is combined with meta-information such as source, timestamp, and credibility to form structured and complete information, which serves as both input data for the analysis agent and as a reference for the dialogue agent in the human-computer interaction process.

[0069] The embodiment of the present invention uses the cosine similarity metric to calculate the similarity between document vectors, and combines the TF-IDF weighting strategy to improve the retrieval weight of key information to output document fragments; uses a large language model to process document fragments to generate text embedding representations, and captures contextual semantic associations through an attention mechanism to output text embedding representations generated after deep semantic matching; performs a multi-round retrieval process including initial retrieval, result reranking, and query rewriting on the text embedding representations generated after deep semantic matching to output an optimized candidate document list; wherein, the initial retrieval generates an initial query vector based on the input, the result reranking is to optimize the ranking according to the relevance score, and the query rewriting is to dynamically adjust the retrieval strategy based on user feedback information; the optimized candidate document list is combined with the source, timestamp, and credibility to obtain structured complete information, and the structured complete information is used as input data for analyzing the intelligent agent system and reference data for the dialogue intelligent agent system in the human-computer interaction process.

[0070] In summary, the present invention includes a dialogue agent, a vulnerability analysis agent, a document analysis agent, and a retrieval agent; wherein the dialogue agent uses a fast thinking mode to process user requests and stores vulnerability analysis requirements in a shared memory, and interacts with the user based on the analysis results in the shared memory; the vulnerability analysis agent decomposes the analysis requirements into subtasks and calls other agents to obtain information, performs cross-layer interactive vulnerability analysis, and outputs the results; the document analysis agent parses the input document and generates a structured representation and returns it to the reasoning agent; the retrieval agent performs multiple rounds of retrieval in the vector database to obtain complete information related to the query; and the agents exchange information through the shared memory to form a collaborative analysis link.

[0071] The large language model-based cross-layer interactive security analysis method for network protocol stacks, according to an embodiment of the present invention, addresses the challenge of cross-layer security analysis of protocol stacks by pioneering an automated analysis framework based on LLM agents. This framework can autonomously analyze complex cross-layer interaction flows between protocols, comprehensively process multi-source protocol specification documents and their corresponding implementation code, and systematically detect and identify potential cross-layer interaction security vulnerabilities in the protocol stack, thereby significantly improving the overall security and robustness of the protocol stack.

[0072] In order to implement the above embodiment, Figure 3 As shown, this embodiment also provides a network protocol stack cross-layer interactive security analysis device 10 based on a large language model, including:

[0073] The conversational intelligent agent system 100 is used to perform intelligent association completion on the user request information to determine the vulnerability analysis requirements, and determine the vulnerability analysis tasks based on the analysis data of the vulnerability analysis requirements by the vulnerability analysis intelligent agent system;

[0074] Vulnerability analysis intelligent agent system 200 is used to decompose vulnerability analysis tasks into multiple subtask units using thought chain technology according to vulnerability analysis requirements, and call other intelligent agent systems to obtain required information to analyze and process cross-layer interaction vulnerabilities and output analysis results;

[0075] The document analysis intelligent agent system 300 is configured to receive document parsing requests initiated by some of the plurality of subtask units to parse the input protocol document and generate a structured data representation; wherein the structured data representation is stored in a pre-built vector database;

[0076] The retrieval intelligent agent system 400 is used to perform generative multi-round retrieval operations in a pre-built vector database to obtain complete information corresponding to the query content, and feed back the retrieved structured complete information to the analysis intelligent agent system and the dialogue intelligent agent system.

[0077] Furthermore, the conversational intelligent agent system 100 is also used to:

[0078] Receive and process user request information; and conduct coherent multi-round conversations with users by tracking conversation history and context status;

[0079] Perform intelligent association completion on the user request information to obtain the user's vulnerability analysis requirements, and store the vulnerability analysis requirements in a preset shared memory;

[0080] Based on the analysis process information and result data of the vulnerability analysis intelligent agent system in the shared memory, the execution process and analysis conclusion of the vulnerability analysis are fed back to the user.

[0081] Furthermore, the vulnerability analysis intelligent agent system 200 is also used to:

[0082] Decompose vulnerability analysis tasks into multiple subtask units according to vulnerability analysis requirements;

[0083] For each subtask, a hybrid retrieval strategy based on keywords and semantic vectors is used to filter out relevant document information from a large number of documents;

[0084] Use a large language model to extract key document information from related document information;

[0085] Use abstract syntax trees and symbolic execution techniques to locate and extract key code information for each subtask;

[0086] The collected key document information and key code information are analyzed using the preset security analysis method, and intermediate reasoning is performed through the constructed reasoning template, preset prompt word triggers and verification mechanism to generate the final vulnerability analysis results.

[0087] Furthermore, the document analysis intelligent agent system 300 is also used to:

[0088] Receive document parsing requests initiated by some task units, use named entity recognition technology to extract protocol-related entities from the input protocol document, and use dependency syntax to analyze the relationship between entities to obtain parsing results;

[0089] Build a message interaction model based on temporal logic based on the extracted entities and the relationships between them to obtain the modeling results;

[0090] The parsing results and modeling results are converted into a unified JSON format document. The generated JSON format document is used for data sharing and query across intelligent agent systems.

[0091] The large language model-based cross-layer interactive security analysis device for network protocol stacks, according to an embodiment of the present invention, addresses the challenge of cross-layer security analysis of protocol stacks by pioneering an automated analysis framework based on LLM agents. This framework can autonomously analyze complex cross-layer interaction flows between protocols, comprehensively process multi-source protocol specification documents and their corresponding implementation code, and systematically detect and identify potential cross-layer interaction security vulnerabilities in the protocol stack, thereby significantly improving the overall security and robustness of the protocol stack.

[0092] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0093] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

Claims

1. A cross-layer interactive security analysis method for network protocol stack based on a large language model, characterized by: include: The conversational intelligent agent system intelligently associates and completes the user's request information to determine the vulnerability analysis requirements, and determines the vulnerability analysis task based on the vulnerability analysis intelligent agent system's analysis data of the vulnerability analysis requirements; The vulnerability analysis intelligent agent system uses the thought chain technology to decompose the vulnerability analysis task into multiple subtask units according to the vulnerability analysis requirements, and calls other functional intelligent agent systems to obtain the required information to analyze and process cross-layer interaction vulnerabilities and output analysis results; The document analysis intelligent agent system receives document parsing requests initiated by some of the multiple subtask units to parse the input protocol document and generate a structured data representation; wherein the structured data representation is stored in a pre-built vector database; The retrieval intelligent agent system performs generative multi-round retrieval operations in a pre-built vector database to obtain complete information corresponding to the query content, and feeds back the retrieved structured complete information to the analysis intelligent agent system and the dialogue intelligent agent system.

2. The method according to claim 1, characterized in that The conversational intelligent agent system intelligently associates and completes the user's request information to determine the vulnerability analysis requirements, and determines the vulnerability analysis tasks based on the vulnerability analysis intelligent agent system's analysis data of the vulnerability analysis requirements, including: The conversational intelligent agent system receives and processes user request information, and conducts coherent multi-round conversations with the user by tracking the conversation history and context status; Perform intelligent association completion on the user request information to obtain the user's vulnerability analysis requirements, and store the vulnerability analysis requirements in a preset shared memory; Based on the analysis process information and result data of the vulnerability analysis intelligent agent system in the shared memory, the execution process and analysis conclusion of the vulnerability analysis are fed back to the user.

3. The method according to claim 2, characterized in that The intelligent associative completion is based on a preset large language model and fine-tunes instructions by constructing a prompt template that contains professional knowledge of protocol stack security analysis. The prompt template includes system role definition, analysis requirement description, and supplementary information acquisition; the analysis conclusions are presented in a layered visual manner, including a protocol stack layered display of vulnerability location information, a quantitative indicator display of risk level, and a priority ranking of repair suggestions.

4. The method according to claim 1, wherein The vulnerability analysis intelligent agent system uses thought chain technology to decompose vulnerability analysis tasks into multiple subtask units according to vulnerability analysis requirements, and calls other functional intelligent agent systems to obtain the required information to analyze and process cross-layer interaction vulnerabilities and output analysis results, including: Decompose vulnerability analysis tasks into multiple subtask units according to vulnerability analysis requirements; For each subtask, a hybrid retrieval strategy based on keywords and semantic vectors is used to filter out relevant document information from a large number of documents; Use a large language model to extract key document information from related document information; Use abstract syntax trees and symbolic execution techniques to locate and extract key code information for each subtask; The collected key document information and key code information are analyzed using the preset security analysis method, and intermediate reasoning is performed through the constructed reasoning template, preset prompt word triggers and verification mechanism to generate the final vulnerability analysis results.

5. The method according to claim 1, wherein The document analysis intelligent agent system receives document parsing requests initiated by some of the multiple subtask units to parse the input protocol document and generate a structured data representation, including: Receive document parsing requests initiated by some task units, use named entity recognition technology to extract protocol-related entities from the input protocol document, and use dependency syntax to analyze the relationship between entities to obtain parsing results; Build a message interaction model based on temporal logic based on the extracted entities and the relationships between them to obtain the modeling results; The parsing results and modeling results are converted into a unified JSON format document. The generated JSON format document is used for data sharing and query across intelligent agent systems.

6. The method according to claim 1, characterized in that The retrieval intelligent agent system performs generative multi-round retrieval operations in a pre-built vector database to obtain complete information corresponding to the query content, and feeds the retrieved structured and complete information back to the analysis intelligent agent system and the dialogue intelligent agent system, including: The cosine similarity metric is used to calculate the similarity between document vectors, and the TF-IDF weighting strategy is combined to improve the retrieval weight of key information to output document fragments; Use a large language model to process document fragments to generate text embedding representations, and use an attention mechanism to capture contextual semantic associations and output the generated text embedding representations after deep semantic matching; The text embeddings generated after deep semantic matching are subjected to a multi-round retrieval process, including initial retrieval, result reranking, and query rewriting, to output an optimized list of candidate documents. Initial retrieval generates an initial query vector based on the input, result reranking optimizes the ranking based on relevance scores, and query rewriting dynamically adjusts the retrieval strategy based on user feedback. The optimized candidate document list is combined with the source, timestamp, and credibility to obtain structured complete information, and the structured complete information is used as input data for the analytical intelligent agent system and reference data for the conversational intelligent agent system during human-computer interaction.

7. A network protocol stack cross-layer interactive security analysis device based on a large language model, characterized in that: include: A conversational intelligent agent system is used to intelligently associate and complete user request information to determine vulnerability analysis requirements, and determine vulnerability analysis tasks based on the analysis data of the vulnerability analysis requirements by the vulnerability analysis intelligent agent system; Vulnerability analysis intelligent agent system, which uses thought chain technology to decompose vulnerability analysis tasks into multiple subtask units according to vulnerability analysis requirements, and calls other functional intelligent agent systems to obtain the required information to analyze and process cross-layer interaction vulnerabilities and output analysis results; a document analysis intelligent agent system, configured to receive document parsing requests initiated by some of the plurality of subtask units, to parse the input protocol document and generate a structured data representation; wherein the structured data representation is stored in a pre-built vector database; The retrieval intelligent agent system is used to perform generative multi-round retrieval operations in a pre-built vector database to obtain complete information corresponding to the query content, and feed back the retrieved structured complete information to the analysis intelligent agent system and the dialogue intelligent agent system.

8. The device according to claim 7, characterized in that Conversational intelligent agent systems are also used to: Receive and process user request information; and conduct coherent multi-round conversations with users by tracking conversation history and context status; Perform intelligent association completion on the user request information to obtain the user's vulnerability analysis requirements, and store the vulnerability analysis requirements in a preset shared memory; Based on the analysis process information and result data of the vulnerability analysis intelligent agent system in the shared memory, the execution process and analysis conclusion of the vulnerability analysis are fed back to the user.

9. The device according to claim 7, characterized in that Vulnerability analysis intelligent agent system is also used for: Decompose vulnerability analysis tasks into multiple subtask units according to vulnerability analysis requirements; For each subtask, a hybrid retrieval strategy based on keywords and semantic vectors is used to filter out relevant document information from a large number of documents; Use a large language model to extract key document information from related document information; Use abstract syntax trees and symbolic execution techniques to locate and extract key code information for each subtask; The collected key document information and key code information are analyzed using the preset security analysis method, and intermediate reasoning is performed through the constructed reasoning template, preset prompt word triggers and verification mechanism to generate the final vulnerability analysis results.

10. The device according to claim 7, characterized in that The document analysis intelligent agent system is also used for: Receive document parsing requests initiated by some task units, use named entity recognition technology to extract protocol-related entities from the input protocol document, and use dependency syntax to analyze the relationship between entities to obtain parsing results; Build a message interaction model based on temporal logic based on the extracted entities and the relationships between them to obtain the modeling results; The parsing results and modeling results are converted into a unified JSON format document. The generated JSON format document is used for data sharing and query across intelligent agent systems.

Images