Training data generation method and device of network attack recognition model, and electronic equipment

Abstract

The invention discloses a training data generation method and device for a network attack recognition model and electronic equipment, and relates to the field of network security, and the method comprises the steps: collecting to-be-recognized emails from a plurality of information sources, carrying out the classification processing and labeling processing of the preprocessed to-be-recognized emails, obtaining a labeled email sample set, and storing the labeled email sample set in a database; extracting content features, sender features, structural features and attachment features to obtain a sample feature set, performing data synthesis by using a generative adversarial network model, generating a synthesized mail sample, converting the labeled mail sample and the synthesized mail sample into a preset model data format, generating a model training data set, training a preset large language model, and obtaining a new mail sample; and identifying whether the contact emails are phishing emails or not through the model. According to the method and the device, the technical problems that omissions of mail filtering are easily caused and the user satisfaction is influenced because a model for identifying phishing mails cannot update training data for identifying an attack mode in time in related technologies are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology or other related fields, and in particular to a method and device for generating training data for a network attack identification model, and electronic equipment. Background Art

[0002] With the rapid development of information technology, the Internet has penetrated into every aspect of people's lives and work. Email, as an important communication tool, is widely used around the world. However, phishing email social engineering attacks have also become an extremely prominent problem in the field of network security.

[0003] In recent years, the number of phishing emails has exploded. Attackers use various methods to create legitimate-looking emails, such as impersonating well-known companies and financial institutions, to obtain sensitive user information such as account passwords, identity information, and bank card details. These attacks are becoming increasingly sophisticated and covert, often incorporating social engineering techniques to exploit users' psychological vulnerabilities, tricking them into clicking malicious links or downloading malicious attachments. These attacks aim to steal information, implant malware, and control user devices. These attacks not only target individual users but also businesses, which can lead to large-scale data breaches, financial losses, and reputational damage.

[0004] Traditional mitigation measures against the threat of social engineering phishing email attacks primarily rely on rule-based email filtering systems. These systems typically determine whether an email is phishing based on characteristics such as the sender's address, subject line, keywords, links, and attachments. However, this approach has significant limitations. Attackers constantly update their attack methods, easily circumventing these simple rule restrictions. For example, they can use legitimate email servers to send emails, making the sender's address appear legitimate, or evade keyword detection by modifying keywords or using images instead of text. Furthermore, rule-based systems often struggle to identify new, highly customized phishing emails because they fail to understand the semantics and intent behind the email content. Furthermore, as attack methods continue to evolve, it becomes difficult for users to keep up and identify all new threats.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] The embodiments of the present invention provide a method and device for generating training data for a network attack identification model, as well as an electronic device, to at least solve the technical problem in the related art that the model for identifying phishing emails fails to timely update the training data for identifying attack methods, which easily causes omissions in email filtering and affects user satisfaction.

[0007] According to one aspect of an embodiment of the present invention, a method for generating training data for a network attack identification model is provided, comprising: collecting emails to be identified from multiple information sources, wherein the types of the collected emails to be identified include: legitimate emails, phishing emails, simulated phishing emails, and synthetic phishing emails; preprocessing each of the emails to be identified, and classifying and labeling the preprocessed emails to be identified to obtain a labeled email sample set, wherein the labeled email sample set includes N labeled email samples with distinguished email types, where N is a positive integer greater than 1; extracting content features, sender features, structural features, and attachment features of each of the labeled email samples to obtain a sample feature set; based on the sample feature set, using a generative adversarial network model to perform data synthesis to generate synthetic email samples; converting the labeled email samples and the synthetic email samples into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the exchanged emails are phishing emails.

[0008] Optionally, the step of collecting emails to be identified from multiple information sources includes: collecting legitimate emails from corporate email servers, network security servers, and anti-virus companies; collecting phishing emails from email gateways, firewalls, or phishing email databases; collecting simulated emails generated during historical participation in phishing drills or network attack and defense drills from corporate mailboxes and internal corporate servers; using preset open source tools to generate various phishing email templates, and generating synthetic phishing emails for various types of email attack scenarios through the phishing email templates.

[0009] Optionally, the step of preprocessing each of the emails to be identified includes: parsing the multi-part structure of each of the emails to be identified to obtain email structure information, wherein the email structure information includes: email body, attachments, sender information and email header; extracting the uniform resource locator URL from the email body and link, parsing the uniform resource locator URL to obtain domain name information and network access path structure; distinguishing the good and evil types of email links based on the domain name information and the network access path structure; and performing data cleaning and text preprocessing on the emails to be identified based on the email structure information, retaining key text content, and completing the email preprocessing operation.

[0010] Optionally, the step of performing data cleaning and text preprocessing on the email to be identified based on the email structure information includes: based on the email structure information, removing duplicate emails to be identified and invalid characters in the email to be identified, and correcting the incorrect format in the email to be identified to complete the data cleaning operation; performing word segmentation on the email body, removing stop words and text noise, extracting key text content in the email body, and completing the text preprocessing operation, wherein the text noise includes at least one of the following: spaces, HTML tags, and preset characters.

[0011] Optionally, the step of extracting the content features, sender features, structural features and attachment features of each of the marked email samples to obtain a sample feature set includes: extracting keywords, suspicious phrases, spelling errors and sentiment information from the email body of each of the marked email samples to obtain the content features of the marked email sample; extracting the email routing information of each of the marked email samples, comparing the email routing information with the normal email routing pattern, and obtaining the structural features of the marked email sample based on the email routing comparison result, the email header and the sender information; extracting the sender information and the sender IP address of each of the marked email samples to obtain the sender features of the marked email sample; extracting the attachment type and attachment information of the attachment of each of the marked email samples, and extracting the email link to obtain the attachment features.

[0012] Optionally, after converting the labeled email samples and the synthetic email samples into a preset model data format and generating a model training data set, it also includes: using a preset supervised learning algorithm to input the model training data set into an initialized large language model to train the large language model; adjusting the model parameters of the large language model according to the model loss function so that the model learns the feature differences between phishing emails and legitimate emails, wherein, during the model learning process, some phishing emails are loaded into the large language model for transfer learning, and the hierarchical structure of the large language model is adjusted; after the large language model is learned, the trained large language model is evaluated using a test data set to obtain an evaluation result; when the evaluation result indicates that the trained large language model meets the email recognition requirements, the training is confirmed to be completed to obtain the trained large language model.

[0013] Optionally, after confirming that the training is completed and the trained large language model is obtained, it also includes: deploying the trained large language model to the email detection system, and using the large language model to identify whether the incoming and outgoing emails are phishing emails; collecting false alarm emails, user feedback information and related email data marked by the user end through the user feedback interface pre-integrated in the email detection system; and updating the large language model based on the false alarm emails, user feedback information and related email data collected by the user feedback interface.

[0014] According to another aspect of an embodiment of the present invention, a training data generation device for a network attack identification model is also provided, including: an email collection unit, configured to collect emails to be identified from multiple information sources, wherein the types of the collected emails to be identified include: legitimate emails, phishing emails, simulated phishing emails, and synthetic phishing emails; an email labeling unit, configured to preprocess each of the emails to be identified, and classify and label the preprocessed emails to be identified to obtain a labeled email sample set, wherein the labeled email sample set includes N labeled email samples with distinguished email types, where N is a positive integer greater than 1; an email feature extraction unit, configured to extract content features, sender features, structural features, and attachment features of each labeled email sample to obtain a sample feature set; an email synthesis unit, configured to perform data synthesis using a generative adversarial network model based on the sample feature set to generate synthetic email samples; a training data set generation unit, configured to convert the labeled email samples and the synthetic email samples into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the exchanged emails are phishing emails.

[0015] Optionally, the email collection unit includes: a first collection module, used to collect legitimate emails from corporate email servers, network security servers and anti-virus companies; a second collection module, used to collect phishing emails from email gateways, firewalls or phishing email databases; a third collection module, used to collect simulated emails generated during historical participation in phishing drills or network attack and defense drills from corporate mailboxes and internal corporate servers; an email template generation module, used to generate various phishing email templates using preset open source tools, and generate synthetic phishing emails for various types of email attack scenarios through the phishing email templates.

[0016] Optionally, the email marking unit includes: an email structure parsing module, which is used to parse the multi-part structure of each email to be identified to obtain email structure information, wherein the email structure information includes: email body, attachments, sender information and email header; a text extraction module, which is used to extract the uniform resource locator URL from the email body and link, parse the uniform resource locator URL, and obtain domain name information and network access path structure; a link type distinction module, which is used to distinguish the good and evil types of email links based on the domain name information and the network access path structure; an email data preprocessing module, which is used to perform data cleaning and text preprocessing on the email to be identified based on the email structure information, retain key text content, and complete the email preprocessing operation.

[0017] Optionally, the email data preprocessing module includes: a deduplication submodule, which is used to remove duplicate emails to be identified and invalid characters in the emails to be identified based on the email structure information, and correct the incorrect format in the emails to be identified to complete the data cleaning operation; a word segmentation submodule, which is used to perform word segmentation on the email body, remove stop words and text noise, extract key text content in the email body, and complete the text preprocessing operation, wherein the text noise includes at least one of the following: spaces, HTML tags, and preset characters.

[0018] Optionally, the email feature extraction unit includes: a first extraction module, used to extract keywords, suspicious phrases, spelling errors and emotional information from the email body of each of the marked email samples to obtain content features of the marked email samples; a second extraction module, used to extract email routing information of each of the marked email samples, compare the email routing information with the normal email routing pattern, and obtain structural features of the marked email samples based on the email routing comparison results, email headers and sender information; a third extraction module, used to extract sender information and sender IP address of each of the marked email samples to obtain sender features of the marked email samples; a fourth extraction module, used to extract attachment type and attachment information of each of the marked email samples, and extract email links to obtain attachment features.

[0019] Optionally, the training data generation device of the network attack identification model also includes: a model training unit, which is used to convert the labeled email sample and the synthetic email sample into a preset model data format to generate a model training data set, and then use a preset supervised learning algorithm to input the model training data set into the initialized large language model to train the large language model; a model learning unit, which is used to adjust the model parameters of the large language model according to the model loss function, so that the model learns the feature differences between phishing emails and legitimate emails, wherein, during the model learning process, some phishing emails are loaded into the large language model for transfer learning, and the hierarchical structure of the large language model is adjusted; a model evaluation unit, which is used to evaluate the trained large language model using a test data set after the large language model is learned, and obtain an evaluation result; a model confirmation unit, which is used to confirm that the training is completed when the evaluation result indicates that the trained large language model meets the email identification requirements, and obtain the trained large language model.

[0020] Optionally, the training data generation device for the network attack identification model also includes: a system model deployment unit, which is used to deploy the trained large language model to the email detection system after confirming that the training is completed and the trained large language model is obtained, and use the large language model to identify whether the incoming and outgoing emails are phishing emails; a user feedback collection unit, which is used to collect false alarm emails, user feedback information and related email data marked by the user end through a user feedback interface pre-integrated in the email detection system; and a model updating unit, which is used to update the large language model based on the false alarm emails, user feedback information and related email data collected by the user feedback interface.

[0021] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any of the above-mentioned methods for generating training data for a network attack identification model.

[0022] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-mentioned methods for generating training data for a network attack identification model.

[0023] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned methods for generating training data for a network attack identification model.

[0024] Based on the above-mentioned public content, multiple information sources can be collected in real time to collect emails to be identified. After email processing, model training data can be provided. Through the training of deep learning models, phishing emails can be identified more accurately, the false alarm rate and missed alarm rate can be reduced, and users can be effectively protected from phishing attacks and user satisfaction can be improved. This solves the technical problem in related technologies that the model for identifying phishing emails fails to update the training data for identifying attack methods in a timely manner, which easily causes omissions in email filtering and affects user satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a flow chart of an optional method for generating training data for a network attack identification model according to an embodiment of the present invention;

[0027] Figure 2 This is a flow chart of training data generation for an optional social engineering attack identification and warning large model according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional phishing email data preprocessing according to an embodiment of the present invention;

[0029] Figure 4 is a schematic diagram of an optional training data generating device for a network attack identification model according to an embodiment of the present invention;

[0030] Figure 5 The present invention is a hardware structure block diagram of an electronic device (or mobile device) for a method for generating training data for a network attack identification model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] To facilitate those skilled in the art to understand the present invention, some of the terms or nouns involved in the embodiments of the present invention are explained below:

[0034] Generative Adversarial Networks (GANs) are deep learning models composed of two neural networks: a generator and a discriminator, which compete to generate new data samples. In this paper, GANs are used to generate email data similar to real phishing emails to expand the training set and improve the model's generalization ability.

[0035] A variational autoencoder (VA) is a generative model that generates new samples by learning the underlying distribution of data. In this paper, a VAE is used to generate new and diverse phishing email samples based on existing phishing email data, enhancing the model's training effectiveness and its ability to respond to different attacks.

[0036] Large Language Model Meta AI (LLaMA) is a large-scale language model designed to advance natural language processing. The Alpaca model is optimized based on the LLaMA model, with enhanced instruction fine-tuning capabilities, enabling Alpaca to better understand and execute tasks related to phishing email detection and identification.

[0037] It should be noted that the training data generation method and device for the network attack identification model in the present disclosure can be used in the field of network security technology when generating training data for the social engineering attack identification and warning model, and can also be used in any field other than the field of network security technology when generating training data for the social engineering attack identification and warning model. The present disclosure does not limit the application field of the training data generation method and device for the network attack identification model.

[0038] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0039] It should be noted that in this disclosure, when collecting and analyzing customer information, the corresponding operation entrance is provided for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0040] The following embodiments of the present invention can be applied to systems / applications / devices for generating training data for various network attack identification models. The present invention can be applied to network security management systems, especially software / systems for email communication security. Specifically, in applications commonly used by enterprises and individual users to prevent phishing email attacks, for example, internal enterprise email systems (used to identify and filter phishing emails received by employees to reduce the risk of data leakage), personal user email security (assisting individual users in identifying potential phishing emails and protecting personal information security), and financial institution email protection (effectively identifying fraudulent activities through email channels in the financial field to protect customer property safety).

[0041] The technical solution provided by this invention enables real-time provision and updating of model training data. Through deep learning model training, phishing emails can be more accurately identified, false positives and false negatives can be reduced, and users can be effectively protected from phishing attacks. By utilizing diverse samples generated by GAN and VAE, the training model can better respond to different types of phishing emails, improving its adaptability and recognition rate for new attacks.

[0042] The present invention generates model training data and uses the large model obtained through training to identify phishing emails, which can overcome many shortcomings of traditional preventive measures. The model can deeply analyze the text content, semantic structure, language style, sending behavior patterns and other aspects of the email, and is not limited to superficial rule judgments. For example, it can learn the subtle differences in language expression between normal emails and phishing emails, such as grammatical errors, inappropriate wording, abnormal tone, etc. in phishing emails; it can also analyze the sender's behavior pattern, such as whether there is an abnormal sending frequency, sending time, recipient range, etc.

[0043] The present invention will be described in detail below with reference to various embodiments.

[0044] Example 1

[0045] According to an embodiment of the present invention, an embodiment of a method for generating training data for a network attack identification model is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0046] Figure 1 is a flow chart of a method for generating training data for an optional network attack recognition model according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0047] Step S101 : Collecting emails to be identified from multiple information sources, wherein the types of the collected emails to be identified include: legitimate emails, phishing emails, simulated phishing emails, and synthetic phishing emails.

[0048] Optionally, the step of collecting emails to be identified from multiple information sources includes: collecting legitimate emails from corporate email servers, network security servers, and anti-virus companies; collecting phishing emails from email gateways, firewalls, or phishing email databases; collecting simulated emails generated during historical participation in phishing drills or network attack and defense drills from corporate mailboxes and internal corporate servers; using preset open source tools to generate various phishing email templates, and generating synthetic phishing emails for various types of email attack scenarios through the phishing email templates.

[0049] This embodiment obtains legitimate email samples from multiple sources, including enterprise email servers, network security servers, and antivirus companies. These legitimate emails include, but are not limited to, daily internal corporate communications, business transactions, and customer service emails, reflecting the patterns and characteristics of normal email communications. Collecting data from enterprise email servers ensures that the types of emails used in actual work environments are captured, including collaborative emails between different departments, financial reports, and technical specifications. This helps the model learn the diversity and structure of legitimate emails. Network security servers and antivirus companies may provide a wider range of legitimate email samples, covering email communications across different industries and contexts. This increases the breadth and depth of the dataset, enabling the model to understand the normal characteristics of various emails.

[0050] Furthermore, this embodiment collects actual phishing email samples from email gateways, firewalls, and specialized phishing email databases. These samples typically contain key features such as malicious links, forged sender addresses, and deceptive content. Email gateways and firewalls are the first line of defense for enterprise network security, intercepting phishing emails entering or attempting to leave the enterprise network, providing the model with first-hand attack samples. The phishing email database, with its extensive accumulation of phishing email examples, provides in-depth analysis of attack methods, such as emails using urgent requests, financial fraud, and identity impersonation, helping the model learn the diversity and evolving trends of phishing emails.

[0051] Furthermore, this embodiment collects simulated phishing emails generated during phishing drills or network attack and defense drills from the internal server history of the enterprise mailbox. Through internal drills, various attack scenarios can be simulated, including credential theft, malicious link insertion, and social engineering phishing. The collected simulated emails not only reflect the typical characteristics of phishing emails, but also cover enterprise-specific attack methods and the specific risks employees may face. This type of data collection helps the model learn the unique manifestations of phishing emails in the enterprise environment, improving the model's recognition effectiveness in the enterprise environment.

[0052] Optionally, this embodiment can utilize pre-defined open-source tools (such as PhishMailer) to generate various phishing email templates. These templates can then be combined with modern generative models such as GANs (Generative Adversarial Networks) and VAEs (Variational Autoencoders) to synthesize diverse phishing email samples based on large datasets. Generating synthetic phishing emails not only increases the size of the dataset but also enriches the attack scenarios required for model training, enabling the model to learn more complex and varied phishing email characteristics, thereby improving its ability to identify new attacks.

[0053] Next, this embodiment ensures that the final generated sample set of labeled emails can accurately reflect the characteristics of various types of emails through comprehensive preprocessing and precise classification and labeling of the emails to be identified, thereby providing high-quality data support for model training.

[0054] Step S102 , pre-processing each mail to be identified, and classifying and labeling the pre-processed mail to be identified to obtain a labeled mail sample set, wherein the labeled mail sample set includes N labeled mail samples with distinguished mail types, where N is a positive integer greater than 1.

[0055] Optionally, the step of preprocessing each email to be identified includes: parsing the multi-part structure of each email to be identified to obtain email structure information, wherein the email structure information includes: email body, attachments, sender information and email header; extracting the uniform resource locator URL from the email body and link, parsing the uniform resource locator URL to obtain domain name information and network access path structure; distinguishing the good and evil types of email links based on the domain name information and network access path structure; based on the email structure information, performing data cleaning and text preprocessing on the email to be identified, retaining key text content, and completing the email preprocessing operation.

[0056] The multi-part structure of each email to be identified is parsed to obtain email structure information including the email body, attachments, sender information and email headers. Among them, the email body provides the basis for content analysis; attachments may contain malicious code or documents; sender information and email headers contain key clues to identify the sender's reputation and the source of the email.

[0057] First, this embodiment can extract all Uniform Resource Locator (URL) links from the email body and parse them to obtain domain name information and network access path structure. URL analysis is crucial because phishing websites often use domain names that are extremely similar to legitimate websites to disguise themselves, and their access paths may contain abnormal or misleading information. By comparing the domain name information with the domain name of the legitimate website and checking whether the network access path is consistent with expectations, a preliminary judgment can be made on the good or bad type of the link, providing more basis for subsequent feature extraction. Next, based on the extracted URL information, this embodiment uses a series of rules and algorithms to distinguish the good and bad types of links. This includes but is not limited to checking whether the domain name belongs to a phishing site on the abnormal list, parsing whether the URL structure is reasonable, and comparing whether the final direction of the link is consistent with the email content or the identity claimed by the sender. Through these operations, malicious links can be distinguished from normal links, providing a basis for subsequent classification and labeling.

[0058] Optionally, the steps of performing data cleaning and text preprocessing on the emails to be identified based on the email structure information include: removing duplicate emails to be identified and invalid characters in the emails to be identified, and correcting incorrect formats in the emails to be identified to complete the data cleaning operation; performing word segmentation on the email body, removing stop words and text noise, extracting key text content in the email body, and completing the text preprocessing operation, wherein the text noise includes at least one of the following: spaces, HTML tags, and preset characters.

[0059] This embodiment cleans the collected emails for identification, including removing duplicates, eliminating invalid characters, and correcting formatting errors to ensure data purity and consistency. Furthermore, text preprocessing involves extracting key textual information from the email body through word segmentation, stop word removal, and noise reduction. This preprocessing also involves removing text noise such as HTML tags, extra spaces, and other pre-defined characters to ensure that the model training process is not misled by irrelevant information and improve the model's ability to capture valid information. After preprocessing, the emails are classified and labeled to generate a labeled email sample set containing N samples, where N is a positive integer greater than 1. Classification primarily refers to clearly identifying emails as "phishing" or "legitimate." Labeling goes a step further, providing detailed annotation of phishing email features, such as whether they contain malicious links, whether the sender's information is forged, and whether specific social engineering techniques are used. This ensures that the model learns these specific attack patterns, thereby improving detection accuracy and coverage.

[0060] Through the above implementation steps, not only can the email data to be processed be effectively cleaned and standardized, but the email types can also be carefully distinguished and labeled, generating a comprehensive and accurate sample set of labeled emails, providing a high-quality, high-definition data set for subsequent large-scale model training, thereby effectively improving the model's recognition ability and early warning efficiency.

[0061] Step S103: extracting content features, sender features, structure features, and attachment features of each marked email sample to obtain a sample feature set.

[0062] Optionally, step S103 includes: extracting keywords, suspicious phrases, spelling errors and sentiment information from the email body of each marked email sample to obtain content features of the marked email sample; extracting email routing information of each marked email sample, comparing the email routing information with the normal email routing pattern, and obtaining structural features of the marked email sample based on the email routing comparison results, email headers and sender information; extracting sender information and sender IP address of each marked email sample to obtain sender features of the marked email sample; extracting attachment type and attachment information of the attachment of each marked email sample, and extracting email links to obtain attachment features.

[0063] In this embodiment, content features are extracted by deeply analyzing the email body to identify keywords, suspicious phrases, spelling errors, and sentiment. By building and maintaining a large vocabulary list related to phishing emails, such as keywords and suspicious phrases like "account about to be frozen," "urgent update," and "security vulnerability," this embodiment can identify these words or phrases appearing in emails, which are often associated with phishing emails. Furthermore, considering that phishing email creators may intentionally or accidentally include spelling errors in emails, such as misspelling the domain name of a well-known company, this embodiment identifies potential spelling errors by comparing the domain name or other text in the email with known correct spellings, which are often a sign of phishing emails. Furthermore, phishing emails often contain strong emotion-inducing language, such as creating a sense of urgency or using threatening language. This embodiment can also utilize sentiment analysis technology to detect the language and tone in the email to identify any abnormal emotional expressions, such as excessive urgency or unusually positive inducements, which are typical characteristics of phishing emails.

[0064] Structural feature extraction focuses on the email's sending path and header information, including email routing, headers, and sender details. For example, when performing email routing comparison, we collect and analyze typical routing information for legitimate emails and then compare it with the routing information for each annotated email sample. Unusual routing patterns may indicate an untrustworthy email source and are a key clue in detecting phishing emails.

[0065] Optionally, the email header in this embodiment includes email metadata, such as the sender, date, and subject. This embodiment performs a comprehensive check of the email header to confirm the sender's identity, the date's logical errors, and the subject's consistency with the email content. Any mismatches indicate potential risks. In addition to checking the sender's address, sender behavior patterns, such as frequency and time of sending, are also analyzed. Unusual sending behavior can also indicate phishing emails.

[0066] Furthermore, the extraction of sender features involves sender identity authentication and behavior analysis, including determining whether the sender is trustworthy by checking the validity of the sender's address and its similarity with known legitimate senders; and obtaining the sender's IP address and comparing it with the geolocation database to confirm whether it comes from the expected geolocation. An abnormal IP geolocation may suggest that the true identity of the email sender does not match the claimed identity.

[0067] Furthermore, for the extraction of attachment features, it is necessary to pay attention to the file type and content contained in the email. Among them, when analyzing the attachment type, it is necessary to check the file extension of the attachment, such as .docx, .pdf, .exe, etc. Certain types of attachments, especially executable files (.exe), may be carriers of malware and require special vigilance. For attachment content scanning, if feasible, this embodiment will scan the attachment content to find known malware signatures or suspicious content patterns. This step can further confirm the security of the attachment.

[0068] In addition to attachments, this embodiment also needs to parse all links in the email, including short links, to check whether the destination matches the claimed address, and check whether the URL structure has common characteristics of phishing websites, such as using a similar domain name but with slightly different spelling.

[0069] Step S104: Based on the sample feature set, a generative adversarial network model is used to perform data synthesis to generate a synthetic email sample.

[0070] In step S104 of this embodiment, a generative adversarial network (GAN) model can be used to perform data synthesis on the sample feature set obtained from S103 to generate synthetic email samples, thereby expanding the diversity and scale of the training data set. In particular, when there are insufficient real phishing email samples, the generation capability of GAN can be used to simulate various phishing email forms that may be encountered in the real world, ensuring that the model can effectively learn and identify attack types that have not yet frequently appeared in real life.

[0071] Before starting data synthesis, this embodiment uses a sample feature set to gain an in-depth understanding and abstract key elements of phishing emails, including but not limited to email content features, sender features, structural features, and attachment features. Generative adversarial networks consist of two parts: a generator and a discriminator. The generator is responsible for creating new samples that resemble real data, while the discriminator is used to determine whether the generated samples are real or fake. This embodiment uses a trained generator to generate synthetic email samples that are similar in appearance to real phishing emails but have different content based on features extracted from real email samples. These samples can simulate different types of phishing emails, such as fake bank notifications and malicious attachments disguised as official documents, thereby increasing the complexity and coverage of the training dataset.

[0072] Furthermore, during data synthesis using the GAN model, this embodiment also emphasizes feature fusion and optimization. This means that not only does the appearance of the generated email match that of a real phishing email, but the inherent characteristics of the email, such as language style, sentiment analysis results, and behavioral patterns, are also ensured to be consistent with real samples. Furthermore, by fine-tuning the parameters of the GAN model, the quality of the generated samples can be optimized, making them more similar to the characteristics of real phishing emails, thereby improving the efficiency and effectiveness of model training.

[0073] Step S105: Convert the labeled email samples and the synthesized email samples into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the incoming and outgoing emails are phishing emails.

[0074] Next, in step S105, this embodiment converts the labeled email samples obtained in S102 and the synthetic email samples generated in S104 into a preset model data format, and generates a model training data set specifically for training, ensuring that all data samples can be correctly interpreted and utilized by the preset large language model to improve the model's generalization ability and recognition efficiency.

[0075] When generating training data, this embodiment ensures that all data samples follow consistent formatting standards, such as those specified by the Alpaca model. This includes specifying fields such as "instruction," "input," "output," "system prompt," and "history." This allows the model to clearly identify the meaning and purpose of each piece of data, simplifying the preparation process for model training. The labeled and synthetic email samples are then combined to create a comprehensive training dataset that encompasses both actual attack cases and a wide range of potential attack scenarios, allowing the training dataset to more comprehensively cover the various possibilities of phishing emails.

[0076] The resulting model training dataset is not only massive, but also clearly structured and rich in features. This allows the model to learn the key differences between phishing and legitimate emails, as well as how to discern phishing signals from subtle details. This high-quality training dataset significantly enhances the model's recognition capabilities, enabling more accurate early warning and prevention of phishing attacks.

[0077] Through the above steps, emails to be identified can be collected from multiple information sources, wherein the types of emails to be identified include: legitimate emails, phishing emails, simulated phishing emails and synthetic phishing emails; each email to be identified is preprocessed, and the preprocessed emails to be identified are classified and labeled to obtain a labeled email sample set, wherein the labeled email sample set contains N labeled email samples with distinguished email types, and the content features, sender features, structure features and attachment features of each labeled email sample are extracted to obtain a sample feature set; based on the sample feature set, a generative adversarial network model is used to perform data synthesis to generate synthetic email samples; the labeled email samples and the synthetic email samples are converted into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the exchanged emails are phishing emails. In this embodiment, multiple information sources can be collected in real time to collect emails to be identified. After email processing, model training data can be provided. Through the training of the deep learning model, phishing emails can be identified more accurately, the false alarm rate and the missed alarm rate can be reduced, and users can be effectively protected from phishing attacks and user satisfaction can be improved, thereby solving the technical problem in related technologies that the model for identifying phishing emails fails to update the training data for identifying attack methods in a timely manner, which easily causes omissions in email filtering and affects user satisfaction.

[0078] Optionally, after converting the labeled email samples and the synthetic email samples into a preset model data format and generating a model training data set, the method further includes: using a preset supervised learning algorithm to input the model training data set into the initialized large language model to train the large language model; adjusting the model parameters of the large language model according to the model's loss function so that the model learns the feature differences between phishing emails and legitimate emails, wherein, during the model learning process, some phishing emails are loaded into the large language model for transfer learning, and the hierarchical structure of the large language model is adjusted; after the large language model is learned, the trained large language model is evaluated using the test data set to obtain an evaluation result; when the evaluation result indicates that the trained large language model meets the email recognition requirements, the training is confirmed to be completed to obtain a trained large language model.

[0079] After completing the preparation of labeling and synthesizing email samples, this embodiment will convert these samples into a preset model data format to generate a model training data set. For example, each sample data will be converted into an Alpaca format containing fields such as instruction (user instructions), input (context or data), output (correct answer or expected output), system (system prompt words), history (conversation history), etc., allowing the model to understand and learn the characteristics of emails in a structured manner.

[0080] It should be noted that this embodiment uses a preset supervised learning algorithm to input the compiled model training dataset into an initialized large language model. This large language model can be any model with advanced language understanding and generation capabilities (such as the Alpaca model). During training, the model continuously attempts to understand and identify the characteristic differences in emails based on a large number of labeled and synthesized email samples. Through supervised learning, the model can learn key features that distinguish phishing emails from legitimate emails, such as suspicious link formats, forged sender information, and unusual email text.

[0081] During model training, this embodiment adjusts the model parameters of the large language model based on the model's loss function to minimize the gap between the model's predicted results and the actual labeled results, thereby improving the model's recognition accuracy. Optimizing the loss function helps the model learn more accurate feature weights, ensuring that when processing new emails, the model can make more accurate classification decisions. Furthermore, to enable the model to quickly adapt to new attacks such as phishing emails, this embodiment also involves loading some phishing emails and performing a transfer learning process. Transfer learning adjusts the model's hierarchical architecture or some parameters, enabling the model to leverage previously learned knowledge and rapidly learn new features of phishing emails, thereby enhancing the model's generalization and recognition capabilities for emerging attacks.

[0082] After the large language model completes the learning process, this embodiment further uses an independent test data set to evaluate the model. The test data set contains a series of established emails, including known phishing emails and legitimate emails, to test the recognition ability of the model. The evaluation results will include a variety of indicators, such as F1-Score, precision, recall, etc. These indicators can comprehensively reflect the performance of the model, including its accuracy and comprehensiveness in identifying phishing emails. If the evaluation results show that the model can meet the pre-set email recognition standards, that is, the model shows high precision and high recall when identifying phishing emails and legitimate emails, then the model training is confirmed to be successful, and the final trained large language model is obtained.

[0083] It is worth noting that the model of this embodiment is not permanently effective after a single training, but requires continuous monitoring and optimization. By collecting the latest phishing email samples, supplementing the existing training data set, and fine-tuning the model based on user feedback to adapt to the ever-changing attack methods, this way, the model can maintain the latest attack recognition capabilities and ensure that it continues to play a key role in future email security protection.

[0084] Optionally, after confirming that the training is completed and the trained large language model is obtained, it also includes: deploying the trained large language model to the email detection system, and using the large language model to identify whether the incoming and outgoing emails are phishing emails; collecting false positive emails marked by the user end, user feedback information and related email data through the user feedback interface pre-integrated in the email detection system; updating the large language model based on the false positive emails, user feedback information and related email data collected by the user feedback interface.

[0085] This example deploys a trained large language model into an existing email detection system. Once deployed, the model assumes the crucial role of identifying incoming and outgoing emails as phishing emails. Using deep learning technology, the model analyzes email text content, structural features, sender behavior, and other aspects, comparing them with previously collected and annotated features to automatically determine email security. This integration allows the model to interact directly with enterprise or user email communications, providing real-time security monitoring and early warning.

[0086] To ensure the smooth deployment and efficient operation of the model, the model must undergo a series of compatibility tests before deployment to confirm that it can run stably in the software and hardware environment of the target email detection system. Based on the results of the previous training and actual needs, the model's judgment threshold for identifying phishing emails is set to balance the recognition sensitivity and false alarm rate to ensure that threats can be discovered in a timely manner without excessive alarms that affect the user experience.

[0087] Furthermore, this embodiment can also collect false positive emails marked by the user end, user feedback information, and related email data through a user feedback interface pre-integrated into the email detection system. This mechanism encourages users to actively participate in the performance evaluation of the model. Once a false positive is discovered, it can be quickly reported through the feedback interface, including a sample of the email considered to be a false positive, a detailed explanation of the false positive cause, and possible improvement suggestions.

[0088] This embodiment utilizes diverse data sources (including antivirus companies, cybersecurity organizations, corporate email servers, and open-source phishing email datasets). After professional analysis and collation, it performs a series of operations, including feature extraction (content, sender, structure, and behavioral characteristics), sample generation (feature expansion and diversification processing), data cleaning and balancing, and data storage. Through this systematic process, a large model can generate accurate attack identification and warning results based solely on specific data inputs, while achieving efficient data storage and index generation. Furthermore, through continuous data collection and updates, it adapts to the ever-changing cyberattack landscape, achieving automated and intelligent attack identification and warning.

[0089] The following describes in detail another optional specific implementation.

[0090] Figure 2 This is a flow chart of training data generation for an optional social engineering attack identification and warning large model according to an embodiment of the present invention, such as Figure 2 As shown, it mainly includes: data source part, data collection part, feature extraction part, sample generation part, data cleaning and balancing part and data storage part. The following is an explanation of these parts respectively.

[0091] 1. Data source part.

[0092] The data used in this implementation comes from a wide range of sources, including antivirus companies, cybersecurity organizations, corporate email servers, and open-source phishing email datasets. Antivirus companies continuously collect large amounts of data related to phishing emails in their daily cybersecurity work. Cybersecurity organizations are also committed to maintaining cybersecurity, collecting phishing email data through various methods and means to provide strong support for research and prevention of phishing attacks. Corporate email servers often receive various types of phishing emails during actual operation. Collecting and analyzing these emails helps understand phishing attack trends targeting specific companies. Open-source phishing email datasets provide researchers with a rich resource for developing and testing phishing email detection systems.

[0093] 2. Data collection part:

[0094] First, define the phishing email attack scenarios: Based on the targets and technical means, phishing emails are subdivided into types such as credential theft, malicious links and attachments, social engineering phishing, fake transactions or billing emails, etc., providing a classification basis for subsequent data collection.

[0095] Then collect real email data: collect actual phishing email samples from email gateways, firewalls or dedicated phishing email databases. These samples contain features such as malicious links, forged sender addresses, misleading content, etc.

[0096] For example, categorizing and collecting data based on different phishing email attack scenarios allows for more targeted acquisition of samples of various attack types. For example, for credential theft phishing emails, samples collected from banking phishing cases can help large models better identify the characteristics of such attacks. For social engineering phishing, samples of emails disguised as colleagues or bosses can help understand the characteristics and patterns of this attack method.

[0097] By segmenting different attack scenarios, we can provide richer feature information for subsequent model training and improve the model's ability to identify various phishing emails.

[0098] First, filter internal email samples: The email gateway and firewall logs of an enterprise's internal email system are a valuable data source. These logs record actual email information passing through the corporate network, allowing us to filter out phishing email samples while also collecting a large number of legitimate emails for comparison. Legitimate emails received by employees on a daily basis reflect normal email communication patterns, providing accurate legitimate email characteristics for the model, helping to improve its accuracy and reliability.

[0099] Then, integrate open source datasets. The phishing and legitimate email data in these datasets can enrich the training data source and ensure data integrity and availability. Different open source datasets may cover emails of different types and domains. By integrating this data, we can increase data diversity and enable the model to learn a wider range of email characteristics. Internal phishing drills can simulate real-world phishing attack scenarios and collect email data that is more realistic. This data can not only be used for model training but also assess employee security awareness and the company's security protection level. Organizing email data from drills by attack type can better understand the effects and characteristics of different attack methods, providing reference for subsequent security training and preventive measures. Simulated phishing email samples can then be generated using pre-set generation tools (such as PhishMailer). These can be customized based on common phishing email templates and scenarios. For example, simulating bank notification emails to trick users into clicking links can help the model learn the characteristics of specific phishing emails. The generated simulated samples can increase the quantity and diversity of training data, especially for rare or difficult-to-obtain phishing email types. Furthermore, using GAN or VAE models to generate diverse synthetic phishing email samples can further increase data diversity and authenticity. These models can learn from the characteristic distribution of existing email data to generate samples similar to real phishing emails. Synthetic samples can help the model better cope with deformation and disguise of phishing emails, improving the model's generalization ability and robustness.

[0100] In this embodiment, emails from corporate mailboxes and phishing drills or attack and defense drills in which the company organizes and participates are collected and organized into a targeted phishing email collection to meet the needs of specific companies or organizations.

[0101] Combined with modern generative models such as GAN (generative adversarial network) and VAE (variational autoencoder), diversified samples are synthesized based on big data models to solve the problems of sample imbalance and insufficient real data, providing a stronger training foundation for large models.

[0102] Data labeling: Manually label the collected and generated emails to clearly distinguish phishing emails from normal emails, and pay attention to marking the details of different types of phishing attacks, such as whether they contain malicious links, forged senders, etc.

[0103] Table 1 below schematically illustrates data for marking collected emails.

[0104] Table 1 Email annotation data

[0105]

[0106] Fine-grained annotation of specific features in phishing emails, including deceptive domain names, suspicious links, and grammatical errors, allows the model to learn the specific characteristics of phishing emails. Fine-grained annotation can improve the model's recognition accuracy for phishing emails and reduce false positives and negatives.

[0107] Figure 3 FIG. 1 is a schematic diagram of an optional phishing email data preprocessing according to an embodiment of the present invention. Figure 3 As shown in the figure, after collecting email data, data cleaning is performed first, including removing duplicate emails, removing invalid characters, and correcting formatting errors. Then, text preprocessing is performed, including word segmentation, removing stop words, and lemmatization / stemming. After completing data cleaning and text preprocessing, email feature extraction is performed, focusing on extracting content features, sender features, structural features, and behavioral features, and finally generating email samples.

[0108] During preprocessing, the multi-part structure of the email is first parsed to extract key information such as the email body, attachments, sender information, and headers to facilitate subsequent processing and analysis. URLs are then extracted from the email body and links, and domain names and path structures are analyzed to determine whether the links are malicious, providing important evidence for identifying phishing emails. Finally, unnecessary HTML tags and noise characters are removed from the email text, retaining the key text content to improve data quality.

[0109] Specifically, data preprocessing includes: 1. Email parsing, which accurately extracts the multi-part structure of an email, including key content such as the body, attachments, and sender information. Addressing compatibility issues with various email formats ensures the program can handle different email formats and improves data usability. Accurately extracting email content is the foundation for subsequent feature extraction. Effective feature extraction and analysis are only possible with complete email information. 2. URL parsing: Using a URL parsing library, we extract URLs from links in the email body and attachments. We then analyze domain name structure and path information to identify malicious features. For example, short link redirects and mismatches between domain names and senders are common characteristics of phishing emails. URL parsing can help the model identify malicious links and improve its detection capabilities. 3. Text cleaning: A text cleaning program is developed to remove noise from email text, such as HTML tags, extra spaces, and special characters, while retaining the key text content. This improves text readability and analyzability, providing cleaner text data for subsequent feature extraction and model learning. Removing noise reduces interference, allowing the model to focus on analyzing and learning the key text content.

[0110] 3. Feature extraction part.

[0111] Extract content-based features, such as keywords, suspicious phrases, spelling errors (such as "****el***" is similar to the real domain name "****el***"), and sentiment analysis (anxious tone, hurried words, etc.) in the email body, to help the model determine whether it is a phishing email based on the email content.

[0112] Specifically, when performing feature extraction, it includes: building a feature extraction module, which is used to extract content-based features such as keywords, suspicious phrases, and spelling errors in emails based on resources such as keyword dictionaries and grammar rule libraries. Using natural language processing technology for sentiment analysis can further understand the emotional tendency of emails and determine whether there are any anomalies. The email structure feature extraction module is used to extract sender information, IP address, email routing information, etc. from the email header, and compare it with known normal email routing patterns to determine whether there are any anomalies. Extracting features based on email structure can help the model understand the sending path and source of the email and identify possible phishing emails. Email structure features can provide additional information for the model, which helps to improve the accuracy and reliability of the model. Link and attachment feature extraction is used to determine whether the email attachment is of a suspicious type based on a predefined list of dangerous attachment types. By simultaneously analyzing features such as the attachment name and size, features based on links and attachments can be extracted.

[0113] 4. Sample generation part.

[0114] For example, you can first configure the Alpaca model training environment and optimize it based on the selected hardware resources to ensure efficient model training. Proper use of hardware resources such as GPUs and CPUs can accelerate model training and improve training efficiency. An optimized training environment provides a solid foundation for model training, ensuring that the model can complete training within a reasonable timeframe.

[0115] The labeled data is then converted to a format acceptable to the Alpaca model, cleaned, and preprocessed to ensure data accuracy and consistency. Data format conversion and preprocessing are prerequisites for model training. Effective training can only be performed if the data meets the model's requirements.

[0116] 5. Data cleaning and balancing part and data storage part.

[0117] After obtaining the training data, the large language model is trained using the training data.

[0118] First, this embodiment uses the Alpaca model as the foundation for the large phishing email model. This model, based on Meta's LLaMA model, boasts powerful language generation and comprehension capabilities. The training data format of the Alpaca model is then followed. Each piece of data contains fields such as instruction (required, user instructions), input (optional, additional context or data), output (required, model response), system (optional, system prompts), and history (optional, conversation history). This makes it suitable for scenarios such as instruction generation, conversational AI tasks, and question answering.

[0119] An example Alpaca format template is as follows:

[0120]

[0121]

[0122] Based on the provided Alpaca format template example, for example, for the task of determining whether an email is a phishing email, sample data containing information such as the email subject, recipient, sender, body, and attachment type is provided to demonstrate how to identify phishing emails based on email features and generate corresponding output.

[0123] Write a script to convert the collected data into the Alpaca format. Assuming that the data structure contains email judgment results, content, and feature descriptions, the script is used to convert it into a JSON file that conforms to the Alpaca format for use in model training.

[0124] Python script example:

[0125]

[0126]

[0127] Then, using supervised learning, the model is trained using a large number of labeled phishing and legitimate email samples, enabling it to learn the characteristics that distinguish between the two. Transfer learning is employed to fine-tune the existing general email classification model using a small amount of phishing email data, improving the model's adaptability to new attacks. By loading a small amount of phishing email data onto the general email classification model for transfer learning and fine-tuning certain layers or parameters, the model can quickly adapt to phishing email detection tasks. Transfer learning leverages the knowledge and experience of the existing general email classification model to accelerate model training and improve its performance.

[0128] Furthermore, model evaluation and optimization are necessary. In this embodiment, the trained model can be evaluated using a test dataset to calculate metrics such as F1-Score, precision, and recall. Model training strategies or parameters can be adjusted based on the evaluation results to continuously optimize model performance. Evaluation metrics can objectively measure model performance and provide a basis for model optimization.

[0129] Furthermore, this embodiment generates adversarial samples. Through the adversarial training method, the model can better cope with the deformation and disguise of phishing emails and improve the robustness of the model. Among them, adversarial training can enhance the model's anti-interference ability, making it more stable and reliable when facing complex phishing email attacks.

[0130] Integrating a user feedback interface into the email detection system makes it easier for users to flag false positives. It also records user feedback and related email data. User feedback is a crucial basis for improving the model. By collecting user feedback, we can promptly identify model deficiencies and implement improvements. This user feedback interface can increase user engagement and satisfaction, making the email detection system more user-friendly and intelligent.

[0131] In this embodiment, user feedback data can be regularly collected and used as new training data or to adjust model parameters, enabling self-correction and continuous optimization of the model. User feedback data can reflect the model's performance in actual use, providing valuable information for model improvement. Continuous model optimization can better adapt to the ever-changing phishing email attack methods, improving the effectiveness and reliability of the email detection system. Based on user feedback and model performance evaluation results, the system's detection rules and models can be updated in a timely manner, ensuring that the system can effectively respond to emerging phishing email attack methods.

[0132] As phishing email attack methods continue to evolve, email detection systems also need to be constantly updated and improved. Timely updates to detection rules and models can maintain the system's advancement and effectiveness, protecting user information security.

[0133] This embodiment provides training data generation for a large-scale model for identifying and warning against social engineering attacks. The data comes from a diverse range of sources, including antivirus companies, cybersecurity organizations, enterprise email servers, and open-source phishing email datasets. This rich data source provides access to a large amount of data covering various attack scenarios and characteristics, greatly enhancing its comprehensiveness and representativeness. Furthermore, this data has been professionally analyzed and collated, resulting in a high degree of credibility and accuracy, providing a solid and reliable training foundation for the large-scale model.

[0134] In terms of feature extraction, this embodiment comprehensively encompasses multiple aspects, including content, sender, structure, and behavior. This allows the large model to fully learn attack patterns and characteristics, significantly improving the accuracy and precision of attack identification. Furthermore, diversified sample generation, through feature expansion and diversified processing, increases data diversity, avoids overfitting, and improves generalization and adaptability to new attacks.

[0135] The following describes it in detail with reference to another embodiment.

[0136] Example 2

[0137] The training data generation device for a network attack identification model provided in this embodiment includes multiple implementation units, each implementation unit corresponding to each implementation step in the above-mentioned embodiment 1.

[0138] Figure 4 is a schematic diagram of an optional training data generating device for a network attack identification model according to an embodiment of the present invention. Figure 4 As shown, the training data generation device of the network attack identification model may include: an email collection unit 41, an email annotation unit 42, an email feature extraction unit 43, an email synthesis unit 44, and a training data set generation unit 45.

[0139] The mail collection unit 41 is used to collect mails to be identified from multiple information sources, wherein the types of mails to be identified include: legitimate mails, phishing mails, simulated phishing mails and synthetic phishing mails.

[0140] The mail labeling unit 42 is used to pre-process each mail to be identified, and classify and label the pre-processed mail to be identified to obtain a labeled mail sample set, wherein the labeled mail sample set includes N labeled mail samples with distinguished mail types, where N is a positive integer greater than 1.

[0141] The email feature extraction unit 43 is configured to extract content features, sender features, structure features, and attachment features of each labeled email sample to obtain a sample feature set.

[0142] The email synthesis unit 44 is used to perform data synthesis based on the sample feature set using a generative adversarial network model to generate a synthesized email sample.

[0143] The training data set generation unit 45 is used to convert the labeled email samples and the synthesized email samples into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the incoming and outgoing emails are phishing emails.

[0144] The training data generating device of the above-mentioned network attack identification model can collect emails to be identified from multiple information sources through the email collection unit 41, wherein the types of emails to be identified include: legitimate emails, phishing emails, simulated phishing emails and synthetic phishing emails, and pre-process each email to be identified through the email labeling unit 42, and classify and label the pre-processed emails to be identified to obtain a labeled email sample set, wherein the labeled email sample set contains N labeled email samples with distinguished email types, and extract the content features, sender features, structure features and attachment features of each labeled email sample through the email feature extraction unit 43 to obtain a sample feature set, and use the generative adversarial network model to perform data synthesis based on the sample feature set through the email synthesis unit 44 to generate synthetic email samples, and convert the labeled email samples and the synthetic email samples into a preset model data format through the training data set generation unit 45 to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the exchanged emails are phishing emails. In this embodiment, multiple information sources can be collected in real time to collect emails to be identified. After email processing, model training data can be provided. Through the training of the deep learning model, phishing emails can be identified more accurately, the false alarm rate and the missed alarm rate can be reduced, and users can be effectively protected from phishing attacks and user satisfaction can be improved, thereby solving the technical problem in related technologies that the model for identifying phishing emails fails to update the training data for identifying attack methods in a timely manner, which easily causes omissions in email filtering and affects user satisfaction.

[0145] Optionally, the email collection unit includes: a first collection module, used to collect legitimate emails from corporate email servers, network security servers and anti-virus companies; a second collection module, used to collect phishing emails from email gateways, firewalls or phishing email databases; a third collection module, used to collect simulated emails generated during historical participation in phishing drills or network attack and defense drills from corporate mailboxes and internal corporate servers; an email template generation module, used to generate various phishing email templates using preset open source tools, and generate synthetic phishing emails for various types of email attack scenarios through phishing email templates.

[0146] Optionally, the email marking unit includes: an email structure parsing module, which is used to parse the multi-part structure of each email to be identified and obtain email structure information, wherein the email structure information includes: email body, attachments, sender information and email header; a body extraction module, which is used to extract the uniform resource locator URL from the email body and link, parse the uniform resource locator URL, and obtain domain name information and network access path structure; a link type distinction module, which is used to distinguish the good and evil types of email links based on the domain name information and network access path structure; an email data preprocessing module, which is used to perform data cleaning and text preprocessing on the email to be identified based on the email structure information, retain key text content, and complete the email preprocessing operation.

[0147] Optionally, the email data preprocessing module includes: a deduplication submodule, which is used to remove duplicate emails to be identified and invalid characters in emails to be identified based on email structure information, and correct incorrect formats in emails to be identified to complete data cleaning operations; a word segmentation submodule, which is used to perform word segmentation on the email body, remove stop words and text noise, extract key text content in the email body, and complete text preprocessing operations, wherein text noise includes at least one of the following: spaces, HTML tags, and preset characters.

[0148] Optionally, the email feature extraction unit includes: a first extraction module, used to extract keywords, suspicious phrases, spelling errors and emotional information from the email body of each marked email sample to obtain content features of the marked email sample; a second extraction module, used to extract email routing information of each marked email sample, compare the email routing information with the normal email routing pattern, and obtain structural features of the marked email sample based on the email routing comparison results, email headers and sender information; a third extraction module, used to extract sender information and sender IP address of each marked email sample to obtain sender features of the marked email sample; a fourth extraction module, used to extract the attachment type and attachment information of the attachment of each marked email sample, and extract the email link to obtain attachment features.

[0149] Optionally, the training data generation device of the network attack identification model also includes: a model training unit, which is used to convert the labeled email samples and the synthetic email samples into a preset model data format to generate a model training data set, and then use a preset supervised learning algorithm to input the model training data set into the initialized large language model to train the large language model; a model learning unit, which is used to adjust the model parameters of the large language model according to the model loss function, so that the model learns the feature differences between phishing emails and legitimate emails, wherein, during the model learning process, some phishing emails are loaded into the large language model for transfer learning, and the hierarchical structure of the large language model is adjusted; a model evaluation unit, which is used to evaluate the trained large language model using a test data set after the large language model learning is completed, and obtain an evaluation result; a model confirmation unit, which is used to confirm that the training is completed when the evaluation result indicates that the trained large language model meets the email identification requirements, and obtain a trained large language model.

[0150] Optionally, the training data generation device for the network attack identification model also includes: a system model deployment unit, which is used to deploy the trained large language model to the email detection system after confirming that the training is completed and the trained large language model is obtained, and use the large language model to identify whether the incoming and outgoing emails are phishing emails; a user feedback collection unit, which is used to collect false alarm emails, user feedback information and related email data marked by the user end through a user feedback interface pre-integrated in the email detection system; and a model updating unit, which is used to update the large language model based on the false alarm emails, user feedback information and related email data collected by the user feedback interface.

[0151] The training data generation device for the above-mentioned network attack identification model may also include a processor and a memory. The above-mentioned email collection unit 41, email marking unit 42, email feature extraction unit 43, email synthesis unit 44, training data set generation unit 45, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0152] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be configured, and kernel parameters can be adjusted to generate training data for a large model for identifying and warning social engineering attacks.

[0153] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0154] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the training data generation method for the network attack identification model of any one of the above-mentioned embodiments.

[0155] According to another aspect of an embodiment of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the training data generation method for the network attack identification model of any one of the above-mentioned embodiments.

[0156] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method for generating training data for the network attack identification model described in each embodiment of the present application.

[0157] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the steps of the method for generating training data for the network attack identification model described in each embodiment of the present application.

[0158] Figure 5 1 is a hardware structure block diagram of an electronic device (or mobile device) for a method of generating training data for a network attack identification model according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include one or more ( Figure 5 (As shown in the figure, 502a, 502b, ..., 502n are used) processor 502 (processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), memory 504 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components than shown, or with Figure 5 Different configurations shown.

[0159] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0160] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0162] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0163] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0164] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0165] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for generating training data for a network attack recognition model, characterized in that: include: Collecting emails to be identified from multiple information sources, wherein the types of the collected emails to be identified include: legitimate emails, phishing emails, simulated phishing emails, and synthetic phishing emails; Preprocessing each of the mails to be identified, and classifying and labeling the preprocessed mails to be identified to obtain a labeled mail sample set, wherein the labeled mail sample set includes N labeled mail samples that have been distinguished by mail type, where N is a positive integer greater than 1; Extracting content features, sender features, structure features, and attachment features of each of the marked email samples to obtain a sample feature set; Based on the sample feature set, using a generative adversarial network model to perform data synthesis to generate a synthetic email sample; The labeled email samples and the synthesized email samples are converted into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the exchanged emails are phishing emails.

2. The training data generation method according to claim 1, characterized in that The steps to collect emails to be identified from multiple sources include: Collect legitimate emails from corporate email servers, network security servers, and anti-virus companies; Collect phishing emails from email gateways, firewalls, or phishing email databases; Collect simulated emails generated during phishing drills or network attack and defense drills from corporate mailboxes and internal servers; Various phishing email templates are generated using preset open source tools, and synthetic phishing emails targeting various types of email attack scenarios are generated using the phishing email templates.

3. The training data generation method according to claim 1, characterized in that The step of pre-processing each of the mails to be identified comprises: Parsing the multi-part structure of each of the to-be-identified emails to obtain email structure information, wherein the email structure information includes: email body, attachments, sender information, and email header; Extracting a Uniform Resource Locator (URL) from the email body and link, parsing the URL to obtain domain name information and a network access path structure; Distinguishing good and bad types of email links based on the domain name information and the network access path structure; Based on the email structure information, data cleaning and text preprocessing are performed on the email to be identified, key text content is retained, and the email preprocessing operation is completed.

4. The training data generation method according to claim 3, characterized in that The step of performing data cleaning and text preprocessing on the email to be identified based on the email structure information includes: Based on the email structure information, duplicate emails to be identified and invalid characters in the emails to be identified are removed, and incorrect formats in the emails to be identified are corrected to complete the data cleaning operation; The email body is segmented to remove stop words and text noise, and key text content in the email body is extracted to complete text preprocessing operations, wherein the text noise includes at least one of the following: spaces, HTML tags, and preset characters.

5. The training data generation method according to claim 1, wherein: The step of extracting content features, sender features, structure features, and attachment features of each of the marked email samples to obtain a sample feature set includes: Extracting keywords, suspicious phrases, misspellings, and sentiment information from the email body of each of the marked email samples to obtain content features of the marked email samples; Extracting mail routing information of each of the marked mail samples, comparing the mail routing information with a normal mail routing pattern, and obtaining structural features of the marked mail sample based on the mail routing comparison result, the mail header, and the sender information; Extracting the sender information and sender IP address of each of the marked email samples to obtain sender features of the marked email samples; The attachment type and attachment information of each of the annotated email samples are extracted, and the email link is extracted to obtain attachment features.

6. The training data generation method according to claim 1, characterized in that After converting the labeled email sample and the synthesized email sample into a preset model data format to generate a model training data set, the method further includes: Using a preset supervised learning algorithm to input the model training data set into the initialized large language model to train the large language model; Adjusting model parameters of the large language model based on the model's loss function so that the model learns the characteristic differences between phishing emails and legitimate emails. During the model learning process, some phishing emails are loaded into the large language model for transfer learning, thereby adjusting the hierarchical structure of the large language model. After the large language model is learned, the trained large language model is evaluated using a test data set to obtain an evaluation result; When the evaluation result indicates that the trained large language model meets the requirements for email recognition, the training is confirmed to be completed, and the trained large language model is obtained.

7. The training data generation method according to claim 1, wherein: After confirming that the training is completed and the trained large language model is obtained, the method further includes: Deploying the trained large language model to an email detection system, and using the large language model to identify whether an incoming or outgoing email is a phishing email; Collecting false positive emails marked by the user end, user feedback information and related email data through the user feedback interface pre-integrated in the email detection system; The large language model is updated based on the false alarm emails, user feedback information and related email data collected by the user feedback interface.

8. A training data generation device for a network attack recognition model, characterized in that: include: An email collection unit, configured to collect emails to be identified from multiple information sources, wherein the types of emails to be identified include: legitimate emails, phishing emails, simulated phishing emails, and synthetic phishing emails; a mail labeling unit, configured to pre-process each of the mails to be identified, and classify and label the pre-processed mails to be identified to obtain a labeled mail sample set, wherein the labeled mail sample set includes N labeled mail samples that have been distinguished by mail type, where N is a positive integer greater than 1; An email feature extraction unit, configured to extract content features, sender features, structure features, and attachment features of each of the labeled email samples to obtain a sample feature set; An email synthesis unit, configured to perform data synthesis based on the sample feature set using a generative adversarial network model to generate a synthesized email sample; A training data set generation unit is used to convert the labeled email samples and the synthetic email samples into a preset model data format to generate a model training data set, wherein the model training data set is used to train a preset large language model, and the preset large language model is used to identify whether the incoming and outgoing emails are phishing emails.

9. An electronic device, characterized in that: The method comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the training data generation method for the network attack identification model described in any one of claims 1 to 7.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method for generating training data for a network attack identification model according to any one of claims 1 to 7 are implemented.

Images