Network attack traffic detection method and apparatus, computer device, and storage medium

Abstract

Embodiments of the present application provide a network attack traffic detection method and device, computer equipment and a storage medium. The method comprises: obtaining to-be-detected traffic and corresponding detection instructions; inputting the to-be-detected traffic and the detection instructions into a large language model to obtain a corresponding traffic detection result; wherein the large language model is trained by a first preset large language model based on a first loss to obtain a second preset large language model, and the second preset large language model is trained based on a second loss; the first loss is determined according to the difference between the predicted to-be-detected traffic and the first sample to-be-detected traffic, and the predicted to-be-detected traffic is obtained by recursive prediction based on the first sample to-be-detected traffic; the second loss is determined based on the difference between the predicted traffic detection result output by the second sample to-be-detected traffic and the sample traffic detection result. In this way, the flexibility and accuracy of network attack traffic detection can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, computer device, and storage medium for detecting network attack traffic. Background Technology

[0002] Cyberattacks are acts by which attackers illegally intrude into, damage, or steal computer systems, networks, and data by exploiting technical means or vulnerabilities. Examples include virus propagation, phishing scams, and DDoS attacks. Cyberattacks can cause serious consequences such as information leakage, data tampering, business interruption, property loss, and even the collapse of social infrastructure. Therefore, in order to maintain the stability of the network ecosystem and the sustainable development of a digital society, it is necessary to detect cyberattacks, identify threats in a timely manner, block attack chains, and protect user privacy and asset security.

[0003] In related technologies, signature-based detection methods are generally used for network attack detection. These methods match known threat patterns in network traffic or system behavior against a predefined signature database of attack signatures. When the detected behavior perfectly matches the attack signatures in the database, the system triggers an alarm and takes defensive measures. However, signature-based detection methods rely on signature databases containing known attack signatures. For novel attacks or unknown threats, especially when attackers use code obfuscation, encryption, or polymorphism to bypass detection, the signature database may fail to recognize them. This results in insufficient accuracy and flexibility in network attack detection. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, computer device, and storage medium for detecting network attack traffic, which can improve the flexibility and accuracy of network attack traffic detection.

[0005] To achieve the above objectives, a first aspect of this application proposes a method for detecting network attack traffic, the method comprising:

[0006] Acquire the traffic to be detected, and the detection instructions generated based on the traffic to be detected;

[0007] The traffic to be detected and the detection command are input into the large language model to obtain the traffic detection result corresponding to the traffic to be detected;

[0008] The large language model is obtained by learning and training the flow pattern of the first preset large language model based on the first loss, and then training the second preset large language model based on the second loss to understand instructions.

[0009] The first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected. The predicted traffic to be detected is obtained by the first preset large language model recursively predicting based on the first sample traffic to be detected.

[0010] The recursive prediction process is a recursive process of generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the traffic to be detected in the first sample, predicting the next traffic feature based on the intermediate prediction sequence, and updating the intermediate prediction sequence according to the next traffic feature.

[0011] The second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result.

[0012] Accordingly, a second aspect of this application provides a network attack traffic detection device, the device comprising:

[0013] The acquisition module is used to acquire the traffic to be detected and the detection instructions generated based on the traffic to be detected;

[0014] The input module is used to input the traffic to be detected and the detection command into the large language model to obtain the traffic detection result corresponding to the traffic to be detected;

[0015] The large language model is obtained by learning and training the flow pattern of the first preset large language model based on the first loss, and then training the second preset large language model based on the second loss to understand instructions.

[0016] The first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected. The predicted traffic to be detected is obtained by the first preset large language model recursively predicting based on the first sample traffic to be detected.

[0017] The recursive prediction process is a recursive process of generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the traffic to be detected in the first sample, predicting the next traffic feature based on the intermediate prediction sequence, and updating the intermediate prediction sequence according to the next traffic feature.

[0018] The second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result.

[0019] In some embodiments, the network attack traffic detection device further includes a training module for:

[0020] The first sample of traffic to be detected is obtained from the preset pre-trained dataset, and the predicted traffic to be detected is obtained by recursively predicting based on the first sample of traffic to be detected using the first preset large language model.

[0021] Based on the difference between the first sample traffic to be detected and the predicted traffic to be detected, a first loss is determined;

[0022] The first preset large language model is trained based on the first loss to obtain the second preset large language model;

[0023] The second sample traffic to be detected, the corresponding sample traffic detection result, and multiple sample detection instructions corresponding to the second sample traffic to be detected are obtained from the preset fine-tuning dataset. The second sample traffic to be detected and each sample detection instruction are then input into the second preset large language model in sequence to obtain the predicted traffic detection result.

[0024] A second loss is determined based on the difference between the predicted flow detection result and the sample flow detection result;

[0025] The second preset large language model is fine-tuned based on the second loss to obtain the large language model.

[0026] In some implementations, the training module is further configured to:

[0027] The first preset large language model generates an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the traffic to be detected in the first sample.

[0028] Based on the intermediate prediction sequence, predict the next flow feature for the next time step, and update the end of the intermediate prediction sequence with the next flow feature to update the intermediate prediction sequence.

[0029] Repeat the steps of predicting the next flow feature for the next time step based on the intermediate prediction sequence, updating the next flow feature to the end of the intermediate prediction sequence, and updating the intermediate prediction sequence until the number of flow features in the recursively updated intermediate prediction sequence is the same as the number of flow features of the first sample to be detected flow. Based on the intermediate prediction sequence corresponding to the last time step, the predicted to be detected flow is obtained.

[0030] In some implementations, the training module is further configured to:

[0031] In the self-attention layer of the second preset large language model, a low-rank adaptation layer is added;

[0032] The parameters of the low-rank adaptive layer are adjusted based on the second loss to obtain a large language model.

[0033] In some embodiments, the network attack traffic detection device further includes a construction module for:

[0034] Acquire attack payload data, normal traffic data, attack traffic data, and vulnerability code data;

[0035] The attack payload data, the normal traffic data, the attack traffic data, and the vulnerability code data are cleaned to obtain multiple initial sample data.

[0036] Each initial sample data is labeled with multiple feature fields according to multiple preset classification fields to obtain the first sample traffic to be detected corresponding to each initial sample data.

[0037] A pre-training dataset is constructed based on multiple first-sample traffic samples to be detected.

[0038] In some embodiments, the network attack traffic detection device further includes a generation module for:

[0039] Obtain multiple preset instruction types;

[0040] For each second sample of traffic to be detected, generate multiple seed instructions corresponding to various instruction types;

[0041] Expand the task instruction corresponding to each seed instruction according to multiple preset network attack categories to obtain multiple sample detection instructions corresponding to each second sample traffic to be detected under the multiple network attack categories;

[0042] Obtain the sample traffic detection result corresponding to each second sample traffic to be detected, and generate a fine-tuning dataset based on multiple second sample traffic to be detected, multiple corresponding sample detection instructions, and multiple corresponding sample traffic detection results.

[0043] In some embodiments, the network attack traffic detection device further includes a mapping module for:

[0044] The traffic detection results are subjected to feature extraction based on the preset vulnerability classification to obtain structured data of the corresponding attack features;

[0045] Obtain a preset security knowledge base, and map the structured data in the security knowledge base to determine the vulnerability entries and threat levels corresponding to the structured data;

[0046] Based on the vulnerability entries and threat levels corresponding to the traffic detection results, a corresponding processing solution is generated.

[0047] Accordingly, a third aspect of the present application provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the network attack traffic detection method of any one of the embodiments of the first aspect of the present application.

[0048] Accordingly, a fourth aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network attack traffic detection method of any one of the embodiments of the first aspect of this application.

[0049] This application embodiment acquires the traffic to be detected and the detection instructions generated based on the traffic to be detected; inputs the traffic to be detected and the detection instructions into a large language model to obtain the traffic detection result corresponding to the traffic to be detected; wherein, the large language model is trained by a first preset large language model based on a first loss to learn traffic patterns, to obtain a second preset large language model, and is trained by the second preset large language model based on a second loss to understand instructions; the first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected, and the predicted traffic to be detected is obtained by the first preset large language model recursively predicting based on the first sample traffic to be detected; the recursive prediction process is to generate an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected, and predict the next traffic feature based on the intermediate prediction sequence, and update the intermediate prediction sequence according to the next traffic feature; the second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result. Therefore, this approach enables the model to learn and train on a large number of traffic patterns without relying on a predefined attack signature library. Recursive prediction training is used to achieve adaptive learning of traffic features, forcing the model to deeply understand the evolutionary patterns of attack behavior hidden within the traffic. Even if the attack traffic is encrypted or segmented, the model can still identify abnormal patterns through contextual dependencies, improving the flexibility and accuracy of network attack traffic detection. Furthermore, training the large language model with a second loss function for instruction understanding endows the model with the ability to dynamically respond to detection needs, allowing it to parse different detection instructions and proactively adjust feature extraction dimensions, overcoming the limitations of rigid rules. In summary, this application enables the model to both identify statistical anomalies of unknown attacks and flexibly switch detection logic according to real-time defense strategies, achieving a dual breakthrough in accuracy and adaptability in dynamic adversarial scenarios. In other words, this application improves the flexibility and accuracy of network attack traffic detection. Attached Figure Description

[0050] Figure 1This is a schematic diagram of the architecture of the network attack traffic detection system provided in the embodiments of this application;

[0051] Figure 2 This is a flowchart of the network attack traffic detection method provided in the embodiments of this application;

[0052] Figure 3 This is a flowchart of the training model provided in the embodiments of this application;

[0053] Figure 4 This is a general flowchart of the network attack traffic detection method provided in the embodiments of this application;

[0054] Figure 5 This is a schematic diagram of the functional modules of the network attack traffic detection device provided in the embodiments of this application;

[0055] Figure 6 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0059] Cyberattacks are acts by which attackers illegally intrude into, damage, or steal computer systems, networks, and data by exploiting technical means or vulnerabilities. Examples include virus propagation, phishing scams, and DDoS attacks. Cyberattacks can cause serious consequences such as information leakage, data tampering, business interruption, property loss, and even the collapse of social infrastructure. Therefore, in order to maintain the stability of the network ecosystem and the sustainable development of a digital society, it is necessary to detect cyberattacks, identify threats in a timely manner, block attack chains, and protect user privacy and asset security.

[0060] In related technologies, signature-based detection methods are generally used for network attack detection. These methods match known threat patterns in network traffic or system behavior against a predefined signature database of attack signatures. When the detected behavior perfectly matches the attack signatures in the database, the system triggers an alarm and takes defensive measures. However, signature-based detection methods rely on signature databases containing known attack signatures. For novel attacks or unknown threats, especially when attackers use code obfuscation, encryption, or polymorphism to bypass detection, the signature database may fail to recognize them. This results in insufficient accuracy and flexibility in network attack detection.

[0061] Based on this, embodiments of this application provide a method, apparatus, computer device, and storage medium for detecting network attack traffic, which can improve the flexibility and accuracy of detecting network attack traffic.

[0062] The network attack traffic detection method, apparatus, computer equipment, and storage medium provided in this application are specifically described through the following embodiments. First, the network attack traffic detection system in this application is described.

[0063] Please refer to Figure 1 In some embodiments, this application provides a network attack traffic detection system, including a terminal 11 and a server 12.

[0064] For example, terminal 11 can be used to collect raw network traffic data and perform preliminary data preprocessing. It can be a network traffic collection device such as a network switch, router or dedicated network traffic collector, or a personal computer or workstation used to capture local traffic, or an Internet of Things device such as a smart camera or smart home device.

[0065] Furthermore, the server side can be a high-performance server, a CPU-accelerated server, a distributed computing cluster, a cloud service platform, etc. Terminal 11 first performs real-time detection and capture of network traffic, then performs basic preprocessing operations such as filtering, decoding Transmission Control Protocol (TCP) streams, and extracting key information from Hypertext Transfer Protocol (HTTP) request / response messages. This converts binary data into readable text format and generates a structured output file. The pre-processed data is uploaded by Terminal 11 to Server 12. Server 12 is responsible for receiving data from different terminals 11 and integrating it into a unified data management system, facilitating subsequent data cleaning, formatting, and the construction of pre-trained and fine-tuned datasets.

[0066] Furthermore, server 12 can utilize the pre-trained and fine-tuned datasets to pre-train and fine-tune the large language model, enhancing its time-series modeling capabilities through autoregressive methods and employing LoRA technology for efficient parameter tuning, enabling the model to better adapt to the specific task requirements of the cybersecurity field. Finally, the trained target model is deployed on server 12 to analyze real-time network traffic data uploaded from terminal 11, identify potential security threats, and map the detection results to security knowledge bases such as the Open Web Application Security Project (OWASP) and Common Weakness Enumeration (CWE), generating detailed attack reports and response suggestions to be fed back to the user or directly triggering defensive measures.

[0067] The network attack traffic detection method in this application can be illustrated by the following embodiments.

[0068] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user will be obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent will the necessary user-related data for the normal operation of the embodiments of this application be obtained.

[0069] In this embodiment, the description will focus on a network attack traffic detection device, which can be integrated into a computer device. See [link to relevant documentation]. Figure 2 , Figure 2 This is a flowchart illustrating the steps of the network attack traffic detection method provided in this application embodiment. Taking the network attack traffic detection device specifically integrated into a terminal or server as an example, the specific process when the processor on the terminal or server executes the program instructions corresponding to the network attack traffic detection method is as follows:

[0070] Step 101: Obtain the traffic to be detected and the detection instructions generated based on the traffic to be detected.

[0071] In some implementations, to lay the foundation for subsequent in-depth analysis and threat handling, the traffic to be detected and the corresponding detection instructions can be obtained to ensure that the subsequent large language model can learn and reason based on real network environment information, thereby improving the accuracy and targeting of the detection.

[0072] The traffic to be detected can be actual network traffic data packets captured from the network environment. These data packets may contain normal business communication content, or they may contain potential attack behaviors or abnormal activities.

[0073] The detection instructions can be specific task instructions that are automatically generated based on the traffic to be detected or manually formulated by technicians, and are used to guide the large language model to perform specific security detection tasks.

[0074] For example, professional traffic capture tools (such as Wireshark and tcpdump) can be used to directly capture data packets from the network interface to obtain the traffic to be detected; alternatively, a mirror port can be configured on a switch or router to copy the traffic of the specified port as the traffic to be detected to the detection device for analysis; or the traffic can be inserted into and copied into the network link through a Test Access Point (TAP) device to obtain the traffic to be detected. In practical applications, there are other ways to obtain the traffic to be detected, and this application does not limit the specific methods of obtaining it.

[0075] Specifically, the traffic to be detected can be internal network traffic, border traffic, cloud environment traffic, terminal traffic, etc.

[0076] Furthermore, to avoid wasting resources, traffic can be initially filtered. For example, traffic from specific protocols or specific Internet Protocol (IP) address ranges can be captured. Filtering rules can be defined using the Berkeley Packet Filter (BPF) syntax.

[0077] For example, the detection instructions to be performed can be determined based on the protocol type of the traffic to be detected. Detection instructions can also be automatically generated based on traffic characteristics, predefined rules, machine learning models, or threat intelligence for subsequent threat analysis and response.

[0078] The model can be required to classify and identify specific types of attack behaviors (such as SQL injection and cross-site scripting attacks), or to extract features and assess risks of unknown traffic patterns. In this technical scenario, detection instructions often combine professional knowledge in the field of cybersecurity and are extended into a richer instruction set through self-instruction methods to enhance the model's learning ability and applicability.

[0079] The above methods provide solid data support and action guidelines for subsequent security analysis, helping to improve the efficiency and accuracy of detecting traffic.

[0080] Step 102: Input the traffic to be detected and the detection command into the large language model to obtain the traffic detection result corresponding to the traffic to be detected;

[0081] Among them, the large language model is trained by learning traffic patterns through the first preset large language model based on the first loss to obtain the second preset large language model, and is trained by the second preset large language model based on the second loss for instruction understanding.

[0082] The first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected. The predicted traffic to be detected is obtained by the first preset large language model based on the first sample traffic to be detected through recursive prediction.

[0083] The recursive prediction process is a recursive process of generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected, and predicting the next traffic feature based on the intermediate prediction sequence, so as to update the intermediate prediction sequence according to the next traffic feature.

[0084] The second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result.

[0085] In some implementations, to obtain detailed detection results for the traffic, the traffic to be detected and the corresponding detection instructions can be input into a specially trained large language model to improve the efficiency and accuracy of the detection.

[0086] In this context, a large language model can be a pre-trained, large neural network model capable of understanding and generating natural language or structured data (such as network traffic). It is used to analyze and interpret network traffic and provide detailed traffic detection results based on given detection instructions.

[0087] The traffic detection result can be the output of a large language model based on the input traffic to be detected and the detection command, which includes information on whether the traffic is a malicious attack and its type.

[0088] The first preset large language model can be an initial version of the large language model, used to learn traffic patterns from a large amount of historical network traffic data, and to perform preliminary training by optimizing the first loss.

[0089] The first loss can be used to measure the difference between the traffic to be detected predicted by the first preset large language model and the actual traffic to be detected in the first sample, and it is the basis for optimizing the model parameters.

[0090] The second preset large language model can be a model trained based on instruction understanding, which is based on the first preset large language model and aims to better understand and execute detection tasks related to traffic detection.

[0091] The second loss can be used to evaluate the difference between the predicted traffic detection result and the actual sample traffic detection result output by the second pre-defined large language model when processing the second sample traffic to be detected, thereby guiding model fine-tuning. Since the second pre-defined large language model has already learned the traffic pattern, it is necessary to train the second pre-defined large language model's ability to understand instructions related to traffic detection. If the second pre-defined large language model can accurately understand the instructions, the second loss will be small; otherwise, it will be large.

[0092] The first sample of traffic to be detected can be sample data used to train a large language model to learn traffic patterns, and it can be known instances of normal and abnormal network traffic. The sample type of each first sample of traffic to be detected can be attack payload, HTTP request fragment, vulnerability code, etc.

[0093] The second sample of traffic to be detected can be sample data used to further train the model to understand specific detection instructions, and it can be known instances of normal and abnormal network traffic.

[0094] The first time step can be the very first point in time in the time series representation of network traffic, and the first time step corresponds to the first feature value of the first sample of traffic to be detected.

[0095] The first traffic feature can be a specific traffic characteristic at the first time step, such as the first HTTP request header field in a TCP stream.

[0096] The intermediate prediction sequence can be a series of predicted values ​​that are gradually constructed during the recursive prediction process and are continuously updated and improved as more time steps of information are added.

[0097] Among them, the predicted traffic detection result can be a result about the nature of the traffic (such as whether there is an attack) predicted by a large language model based on the input traffic and detection instructions.

[0098] The sample flow detection results can be known standard answers or flow detection results under real conditions, used to compare and evaluate the accuracy of model predictions.

[0099] For example, if it is necessary to detect whether the network traffic of company A contains potential malicious behavior (such as SQL injection attacks), and the traffic to be detected is:

[0100] Timestamp: 2025-04-14T10:00:00;

[0101] Source IP: 192.168.1.10;

[0102] Target IP: 203.0.113.5;

[0103] Protocol: HTTP;

[0104] Request content: GET / login? username=admin'OR'1'='1'--HTTP / 1.1;

[0105] For example, if the detection instruction generated based on the traffic to be detected is:

[0106] Check HTTP requests for SQL injection keywords (such as "OR'1'='1'", "UNIONSELECT", etc.); if SQL injection characteristics are found, mark it as high-risk traffic and generate an alert log.

[0107] The traffic to be detected and the detection commands are input into a trained large language model. The large language model first parses the content of the traffic and extracts key fields (such as timestamp, source IP, destination IP, protocol type, request content, etc.). Then, the large language model understands the requirements of the detection commands, identifies the key features to be detected (such as SQL injection keywords), and obtains the corresponding traffic detection results. For example, the traffic detection results could be:

[0108] Traffic flow detection results:

[0109] Testing status: High risk;

[0110] Reason for detection: SQL injection keyword "OR'1'='1'" was found;

[0111] Response Recommendation: Mark the traffic as high-risk, generate an alert log, and notify the security team;

[0112] For example, detection commands can also be automatically generated by the model from key fields in the traffic to be detected. For instance, if the request content contains the suspicious SQL injection keyword "OR'1'='1'", and other fields (such as source IP and target IP) show no obvious anomalies, the model can infer that this may be an SQL injection attack attempt based on these key fields. Based on the above analysis, the model can automatically generate a detection command for this type of threat and apply the generated detection command to the detection of the current traffic or other similar traffic to be detected. This can improve detection efficiency and accuracy and reduce reliance on manual intervention. Alternatively, detection commands can also be manually written based on the experience of security experts. The form and settings of the detection commands can be set according to the actual situation, and this application does not impose specific limitations on this.

[0113] For example, model training can be divided into two stages: traffic pattern learning training based on the first loss and instruction understanding training based on the second loss. The training process for these two stages will be described below.

[0114] For example, since network traffic has complex patterns and structures, which may include time series features, protocol types, packet sizes, etc., in the first stage of model training, this application uses a recursive prediction method to force the first preset large language model to learn these patterns, so that the model can better understand and predict future traffic, thereby identifying anomalies.

[0115] Specifically, the first sample of traffic to be detected can be input into the first preset large language model. The first preset large language model is used to analyze the traffic features of the first time step (such as the first character or field of the first sample of traffic to be detected), and the traffic features of the next time step are predicted based on the traffic features of the first time step. The intermediate prediction sequence is updated based on the traffic features of the first time step and the traffic features of the next time step, and the traffic features of the next time step are predicted based on the updated intermediate prediction sequence. The intermediate prediction sequence is continuously updated until the prediction of the entire traffic sequence is completed. That is, the prediction stops when the number of features in the updated intermediate prediction sequence is consistent with the number of features in the first sample of traffic to be detected, and the predicted traffic to be detected is obtained.

[0116] Furthermore, if the first preset large language model can correctly learn the network traffic patterns, the predicted traffic to be detected should be consistent with the first sample traffic to be detected, meaning the first loss constructed based on the difference between the two is small; otherwise, the first loss is large. The first loss cross-entropy can be calculated after each prediction of new traffic to be detected, and the parameters of the first preset large language model can be adjusted according to the first loss to obtain the second preset large language model.

[0117] For example, the first loss could be mean squared error loss, cross-entropy loss, or sequence-to-sequence loss, etc. The specific loss function can be selected to calculate the first loss according to the actual situation.

[0118] For example, once the model has developed a good ability to recognize traffic patterns, it can be further trained in the second stage to understand specific detection instructions and generate accurate detection results based on these instructions.

[0119] Specifically, in the second stage of training the second preset large language model, namely the fine-tuning stage, each second sample of traffic to be detected and its corresponding sample detection instruction can be input into the second preset large language model. The second preset large language model can process the corresponding second sample of traffic to be detected according to the given sample detection instruction and generate the corresponding predicted traffic detection result. For example, if the predicted traffic detection result for the second sample of traffic to be detected, A, is:

[0120] Testing status: High risk;

[0121] Reason for detection: SQL injection keyword "OR'1'='1'" was found.

[0122] The sample flow detection result for the second sample, flow A, is as follows:

[0123] Testing status: High risk;

[0124] Reason for detection: SQL injection keyword "OR'1'='1'" was found.

[0125] If the predicted traffic detection result perfectly matches the sample traffic detection result, the second loss is small or zero; otherwise, the second loss is large. Fine-tuning the second preset large language model based on the second loss can enhance the model's ability to generate targeted responses according to specific instructions, thus improving the effectiveness of the response.

[0126] For example, the second loss can be classification loss, regression loss, or cross-entropy loss, etc. The specific loss function can be selected to calculate the second loss according to the actual situation.

[0127] This application embodiment acquires the traffic to be detected and the detection instructions generated based on the traffic to be detected; inputs the traffic to be detected and the detection instructions into a large language model to obtain the traffic detection result corresponding to the traffic to be detected; wherein, the large language model is trained by a first preset large language model based on a first loss to learn traffic patterns, to obtain a second preset large language model, and is trained by the second preset large language model based on a second loss to understand instructions; the first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected, and the predicted traffic to be detected is obtained by the first preset large language model recursively predicting based on the first sample traffic to be detected; the recursive prediction process is to generate an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected, and predict the next traffic feature based on the intermediate prediction sequence, and update the intermediate prediction sequence according to the next traffic feature; the second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result. Therefore, this approach enables the model to learn and train on a large number of traffic patterns without relying on a predefined attack signature library. Recursive prediction training is used to achieve adaptive learning of traffic features, forcing the model to deeply understand the evolutionary patterns of attack behavior hidden within the traffic. Even if the attack traffic is encrypted or segmented, the model can still identify abnormal patterns through contextual dependencies, improving the flexibility and accuracy of network attack traffic detection. Furthermore, training the large language model with a second loss function for instruction understanding endows the model with the ability to dynamically respond to detection needs, allowing it to parse different detection instructions and proactively adjust feature extraction dimensions, overcoming the limitations of rigid rules. In summary, this application enables the model to both identify statistical anomalies of unknown attacks and flexibly switch detection logic according to real-time defense strategies, achieving a dual breakthrough in accuracy and adaptability in dynamic adversarial scenarios. In other words, this application improves the flexibility and accuracy of network attack traffic detection.

[0128] Please refer to Figure 3 In some implementations, to enable the large language model to accurately identify network attack traffic, the model can be pre-trained using a pre-set pre-training dataset to initially grasp traffic patterns. Then, the model parameters are further optimized using a pre-set fine-tuning dataset, allowing it to accurately understand and execute specific detection instructions. For example, the large language model can be trained in the following way:

[0129] Step 201: Obtain the first sample traffic to be detected from the preset pre-trained dataset, and recursively predict the traffic to be detected based on the first sample traffic using the first preset large language model;

[0130] Step 202: Determine the first loss based on the difference between the first sample flow to be detected and the predicted flow to be detected;

[0131] Step 203: Train the first preset large language model based on the first loss to obtain the second preset large language model;

[0132] Step 204: Obtain the second sample traffic to be detected, the corresponding sample traffic detection result, and multiple sample detection instructions corresponding to the second sample traffic to be detected from the preset fine-tuning dataset, and input the second sample traffic to be detected and each sample detection instruction into the second preset large language model in sequence to obtain the predicted traffic detection result.

[0133] Step 205: Determine the second loss based on the difference between the predicted flow detection result and the sample flow detection result;

[0134] Step 206: Fine-tune the second preset large language model based on the second loss to obtain the large language model.

[0135] The pre-training dataset can be an unstructured / weakly structured corpus composed of original data from the attack detection field (such as network traffic, attack payloads, and vulnerability code), used to perform secondary pre-training on the first pre-set large language model (such as LLaMA2) so that it learns the grammatical structure of network traffic, attack behavior characteristics, and vulnerability code logic.

[0136] Among them, the fine-tuning dataset can be a task-oriented dataset composed of command and response pairs, used to align the specific capabilities of large language models in attack detection scenarios (such as classification and entity recognition).

[0137] Sample detection instructions can be specific task instructions provided to the large language model during the fine-tuning phase to guide the model in processing and analyzing the input traffic to be detected. For example, a sample detection instruction might require the model to identify a specific type of attack (such as SQL injection), extract certain key information from the traffic (such as IP addresses), or interpret the behavior of the traffic, etc. Sample detection instructions are used to enable the model to better understand and adapt to the complex needs of real-world applications.

[0138] In some implementations, each first sample of traffic to be detected in the pre-training dataset can be a piece of text or a structured data fragment containing attack features or normal traffic features. When the first sample of traffic to be detected is obtained from the preset pre-training dataset and used for secondary pre-training of the first preset large language model, the model needs to recursively predict the traffic features of subsequent time steps to force the model to understand the causal logic in the attack traffic and master the network traffic syntax structure (such as HTTP protocol format) and attack behavior patterns (such as SQL injection payload features, for example, the injection pattern of SELECT * FROM users WHERE followed by username = 'admin'--).

[0139] Specifically, during the training of the first pre-defined large language model, each first sample of traffic to be detected can be divided into multiple traffic features according to multiple time steps. The first pre-defined large language model then predicts the traffic features of the next adjacent time step based on the first traffic feature corresponding to the first time step. The traffic features of the next time step are then updated to the intermediate prediction sequence containing the traffic features of the first time step, resulting in an updated intermediate prediction sequence. Subsequently, the traffic features of the next time step can be predicted based on the updated intermediate prediction sequence, and so on, until the predicted traffic to be detected is finally obtained.

[0140] Furthermore, a first loss can be calculated based on the difference between the first sample of traffic to be detected and the predicted traffic to be detected. For example, the first loss could be the cross-entropy loss L. pre-train The formula is as follows:

[0141]

[0142] Where T is the total number of time steps divided into multiple time steps for the first sample of traffic to be detected, θ is the model parameter, and x ＜t x represents the traffic characteristics corresponding to the previous time step. t For based on x ＜t The predicted traffic characteristics.

[0143] Furthermore, after calculating the first loss, the model parameters of the first preset large language model can be adjusted through backpropagation to make it more inclined to generate sequences consistent with the real traffic.

[0144] Specifically, each second sample traffic to be detected in the fine-tuning dataset is associated with at least one corresponding sample detection command and sample traffic detection result. For example, each second sample traffic to be detected could be GET / search?q= <script>alert(1)< / script>HTTP / 1.1, its associated sample detection command can detect whether the following requests are XSS attacks. If so, it extracts the attack payload, and the sample traffic detection result can be "Attack type: XSS\nAttack payload: <script>alert(1)< / script> "Then, if the second preset large language model outputs the attack type as XSS based on the second sample of traffic to be detected: Attack payload: " <script>alert(1)< / script> When the second preset language model outputs an attack type of no attack, the second loss is lower; conversely, when the second preset language model outputs an attack type of no attack, the loss is higher.

[0145] Furthermore, the second loss can also be calculated based on the cross-entropy loss. Based on the second loss, the model parameters are updated through gradient descent to enhance the correlation between the second preset large language model's learning of attack features and instructions. This aligns the pre-trained model's generation capability with specific security analysis tasks, enabling it to generate accurate predicted traffic detection results based on instructions.

[0146] By performing secondary pre-training and fine-tuning on a large language model, it can gradually learn general patterns of network traffic and features specific to attack detection tasks. The pre-training stage utilizes a large-scale dataset for recursive prediction, enhancing the model's ability to learn traffic patterns. The fine-tuning stage further optimizes the model's performance on attack detection tasks through task-oriented instructions and labeled data, thereby improving the model's accuracy and flexibility in detecting network attack traffic, enabling it to more effectively identify new and complex attacks.

[0147] In some implementations, to enhance the first preset large language model's ability to understand and model traffic patterns, a predicted traffic sequence can be generated through recursive prediction. This allows the first preset large language model to capture dynamic changes and time dependencies in the traffic data, providing a more accurate learning foundation for subsequent attack detection tasks. For example, step 201, "recursively predicting based on the first sample traffic to be detected using the first preset large language model to obtain the predicted traffic to be detected," may include:

[0148] (201.1) Generate an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected using the first preset large language model;

[0149] (201.2) Based on the intermediate prediction sequence, predict the next flow feature of the next time step, and update the next flow feature to the end of the intermediate prediction sequence to update the intermediate prediction sequence;

[0150] (201.3) Repeat the step of predicting the next flow feature for the next time step based on the intermediate prediction sequence, updating the next flow feature to the end of the intermediate prediction sequence, and updating the intermediate prediction sequence until the number of flow features in the recursively updated intermediate prediction sequence is the same as the number of flow features in the first sample to be detected flow. Based on the intermediate prediction sequence corresponding to the last time step, the predicted to be detected flow is obtained.

[0151] The next traffic feature can be a traffic feature value predicted at the next time step based on the current intermediate prediction sequence during the recursive prediction process. The next traffic feature can be a specific traffic attribute at the next time point, such as a field in the next HTTP request header or a portion of the response body content.

[0152] The last time step can be the time step reached at the end of the entire recursive prediction process, at which point the number of traffic features in the intermediate prediction sequence matches the actual number of features of the first sample traffic to be detected. In other words, when the recursive prediction process is completed and the intermediate prediction sequence contains the same number of features as the original sample traffic, that time step is the last time step. At this point, based on this complete and continuous intermediate prediction sequence, the final predicted traffic to be detected can be generated.

[0153] For example, based on an autoregressive generation mechanism, the first pre-defined large language model starts from the first traffic feature at the first time step and gradually predicts subsequent traffic features. Each prediction step relies on the updated intermediate prediction sequence, ultimately generating a complete prediction of the traffic to be detected. In this way, the model can learn more complex traffic patterns, thereby improving its generalization ability. An example of this process is given below.

[0154] For example, first, the first traffic feature of the first time step (e.g., POST) is input. At this point, the intermediate prediction sequence is "POST". Then, based on the intermediate prediction sequence "POST", the feature of the next time step (e.g., / login) is predicted and added to the end of the intermediate prediction sequence, resulting in the updated intermediate prediction sequence "POST, / login". Next, based on "POST, / login", the feature of the next time step (e.g., ?user=" is predicted and added to the end of the intermediate prediction sequence, resulting in the updated intermediate prediction sequence "POST, / login, ?user=", and so on, until the number of traffic features in the intermediate prediction sequence is the same as the number of traffic features in the first sample of traffic to be detected.

[0155] In some implementations, to avoid error accumulation, the intermediate prediction sequence can be predicted in the following way: Using a sliding window, the first sample traffic feature of the first time step is extracted from the first sample traffic to be detected, and an intermediate prediction sequence is generated based on the first sample traffic feature. A first preset large language model is used to predict the next traffic feature corresponding to the next time step based on the intermediate prediction sequence. Using a sliding window, the next sample traffic feature of the next time step is extracted from the first sample traffic to be detected, and the next sample traffic feature is updated to the end of the intermediate prediction sequence. The first preset large language model is used to predict the next traffic feature corresponding to the next time step based on the intermediate prediction sequence. This process is repeated until the sum of the first sample traffic feature and multiple traffic features equals the number of traffic features in the first sample traffic to be detected. Based on the first sample traffic feature and multiple traffic features, a predicted traffic to be detected is generated. In this way, prediction sequences can be gradually constructed, improving training efficiency and model flexibility while reducing error accumulation. For example, the following describes the steps for generating predicted traffic flow using the above method:

[0156] For example, the first sample of traffic to be detected is:

[0157] GET / index.htmlHTTP / 1.1\r\nHost:example.com\r\nUser-Agent:Mozilla / 5.0(WindowsNT10.0;Win64;x64)\r\n\r\n;

[0158] Then, by using a sliding window, the first sample traffic feature of the first time step (e.g., time step 1) can be extracted as "GET", generating an intermediate prediction sequence "GET". Based on the intermediate prediction sequence, the first preset large language model can predict the next traffic feature ":example" for the next time step (e.g., time step 2). The sample traffic feature of the next time step (e.g., time step 2) is extracted based on the first sample traffic to be detected, resulting in " / index.html". " / index.html" is then added to the end of "GET", resulting in the updated intermediate prediction sequence "GET / index.html". Afterwards, the traffic feature for the next time step (e.g., time step 3) is predicted based on the intermediate prediction sequence, for example, " / 5.0". Continuing with the sliding window, the sample traffic features for the next time step (e.g., time step 3) are extracted based on the first sample traffic to be detected, resulting in "HTTP / 1.1". This "HTTP / 1.1" is then used to update the end of "GET / index.html", resulting in the updated intermediate prediction sequence "GET / index.html HTTP / 1.1". This process continues until the total number of traffic features from the first sample and the multiple traffic features equals the number of traffic features from the first sample traffic to be detected. At this point, the predicted traffic to be detected can be generated based on the first sample traffic features and the multiple traffic features. It should be noted that in this example, the sample traffic features can be features extracted from the corresponding time step of the first sample traffic to be detected, while the traffic features are the predicted features from the corresponding time step.

[0159] By recursively predicting and gradually building the predicted traffic sequence, the model's ability to understand traffic patterns can be enhanced, providing a more accurate foundation for traffic pattern learning for subsequent attack detection tasks and improving the model's detection performance and adaptability in complex network environments.

[0160] In some implementations, to maintain the overall stability of the model while achieving customized optimization for specific tasks, a low-rank adaptation layer (LoRA) can be introduced to efficiently fine-tune a second pre-defined large language model (such as LLaMA2). This reduces the consumption of computational resources and training time, and effectively avoids the performance degradation that may result from large-scale adjustments to the entire model. For example, step 206 may include:

[0161] (206.1) Add a low-rank adaptation layer to the self-attention layer in the second preset large language model;

[0162] (206.2) The parameters of the low-rank adaptation layer are adjusted based on the second loss to obtain the large language model.

[0163] The self-attention layer can be one of the key components in a large language model. It allows the large language model to pay attention to the relationships between different positions within a sequence when processing sequence data (such as text or network traffic), thereby dynamically adjusting the degree of importance given to each part of the input sequence, and thus more accurately capturing long-distance dependencies and complex pattern features.

[0164] Among them, the Low-Rank Adaptation Layer (LoRA) can be a trainable parameter layer introduced through low-rank matrix factorization based on the weights of the second preset large language model.

[0165] In some implementations, low-rank adaptation layers can be added to some or all of the four weight matrices—query (Q), key (K), value (V), and output (O)—to inject task-specific knowledge through low-rank decomposition. For example, they can be added to the query matrix (Q) and the value matrix (V), where the query matrix (Q) can be used to learn task-related attention focusing patterns (e.g., focusing on sensitive fields in attack payloads); and the value matrix (V) can be used to adjust the feature representation after adjusting the attention weights (e.g., strengthening the semantic encoding of malicious traffic features).

[0166] In some implementations, in addition to self-attention layers, low-rank adaptation layers can also be applied to the weight matrix of the model's feedforward network, the model's embedding layer, and so on.

[0167] For example, the parameters of the low-rank matrices A and B can be updated based on the value of the first loss function using the backpropagation algorithm. After multiple iterations, the parameters of the rank adaptation layer are gradually adjusted to the optimal state.

[0168] By employing the LoRA method to fine-tune the second pre-set large language model, minimal updates can be made to a large-scale pre-trained model, enabling efficient and customized optimization for specific tasks. During fine-tuning, by combining the fine-tuning dataset with specific tasks in the cybersecurity domain, such as attack type classification, entity recognition, and abnormal traffic detection, the second pre-set large language model is trained to better understand and identify complex security threats. This fully leverages the language understanding capabilities of the second pre-set large language model while ensuring its efficient application in the cybersecurity field.

[0169] In some implementations, to provide a foundation for subsequent large language model training, various types of cybersecurity data can be collected and processed, cleaned, and classified to construct a high-quality pre-training dataset. This ensures the model can learn rich network traffic patterns and security threat characteristics, thereby improving its ability to detect new or unknown attacks. For example, before step 201, i.e., before "obtaining the first sample of traffic to be detected from the preset pre-training dataset and recursively predicting the predicted traffic based on the first sample of traffic to be detected using the first preset large language model," the following steps may also be included:

[0170] (A.1) Obtain attack payload data, normal traffic data, attack traffic data, and vulnerability code data;

[0171] (A.2) Perform data cleaning processing on attack payload data, normal traffic data, attack traffic data and vulnerability code data to obtain multiple initial sample data;

[0172] (A.3) Label the multiple feature fields contained in each initial sample data according to the preset multiple classification fields to obtain the first sample traffic to be detected for each initial sample data;

[0173] (A.4) Construct a pre-training dataset based on multiple first sample traffic flows to be detected.

[0174] The attack payload data can be the actual threat content transmitted in a network attack, including the original attack string, encoded / transformed payloads, such as Base64 encoded SQL injection statements, binary payloads of malicious file uploads, etc.

[0175] Normal traffic data can be regular network traffic that does not contain attack behavior. It is used to establish a baseline model and distinguish between normal and abnormal behavior. For example, normal traffic data can be ordinary HTTP requests, HTTPS encrypted communication traffic, and JSON responses from normal calls to Application Programming Interfaces (APIs).

[0176] Among them, attack traffic data can be network traffic samples that record attack behavior, containing the complete attack request and response interaction process. For example, attack traffic data can be XML entity injection traffic of XXE attack, cross-domain request traffic of cross-site request forgery (CSRF) attack, flood packets of distributed denial of service (DDoS) attack, etc.

[0177] The vulnerability code data can be sample code or descriptions of known vulnerabilities, used to associate attack traffic with potential vulnerabilities.

[0178] The initial sample data can be structured data that has been cleaned (denoising, deduplication, and error correction) and standardized (JSON formatting), containing the core information of the original data.

[0179] The classification field can be a predefined field used to mark sample categories and attributes, such as data type, attack type, vulnerability association, risk level, timestamp, etc.

[0180] Among them, the feature fields can be detailed information describing the specific characteristics of each initial sample data, such as network layer features (e.g., source IP, destination IP, port number, protocol type), application layer features (e.g., HTTP request headers, request body, response status codes), attack features (e.g., malicious patterns in the payload, encoding methods), context features (e.g., timestamps, session IDs, traffic size), etc.

[0181] For example, you can download raw payload files (such as payload.txt) for SQL injection or XSS attacks from a public vulnerability database (such as Exploit-DB). Alternatively, you can use tools to generate modified attack payloads, such as Base64-encoding or URL-encoding SQL statements.

[0182] For example, normal traffic data can be obtained from an enterprise's internal network (such as user browsing behavior logs of an e-commerce website) or from a public dataset.

[0183] For example, attack traffic data can be obtained from attack session packet capture (PCAP) files generated by Metasploit (such as buffer overflow attacks). Alternatively, attack traffic data can be obtained from a complete attack chain captured during penetration testing (such as from port scanning to exploitation).

[0184] For example, vulnerability code data can be obtained from security bulletins or from exploit code associated with the Common Vulnerabilities and Exposures (CVE) database.

[0185] In some implementations, when data cleaning is performed on attack payload data, normal traffic data, attack traffic data, and vulnerability code data to obtain multiple initial sample data, regular expressions can be used to identify abnormal traffic containing non-ASCII characters (such as binary obfuscated data). HTTP status code verification is then performed to remove server error records with a 500 status code and an empty response body. Next, HTTP request headers are rearranged alphabetically (e.g., to standardize the position of the Host field), duplicate payloads are removed (by calculating the hash value of the attack payload and removing duplicate samples with the same hash), and so on. Finally, the PCAP file is parsed into JSON format (preserving key metadata) for structured processing, and so on.

[0186] For example, the classification fields can be protocol type, attack stage, attack vector, etc. For instance, SQL injection samples can be labeled as {"protocol": "HTTP / 1.1", "attack stage": "exploitation", "vector type": "text", "CWE-ID": "CWE-89"}; and normal login traffic can be labeled as {"protocol": "HTTPS", "attack stage": "none", "vector type": "normal"}. In this way, multiple first-sample traffic samples can be obtained to more accurately describe and distinguish different types of network traffic, thereby providing richer semantic information for model training and improving the model's ability to identify and detect attack traffic.

[0187] In some implementations, the feature fields can be set according to the actual situation, such as including timestamps, etc.

[0188] In some implementations, a pre-training dataset can be generated based on multiple first-sample traffic samples to be detected. Alternatively, the multiple first-sample traffic samples to be detected can be divided into a pre-training dataset and a validation set according to a preset ratio, for example, the training set and validation set can be split in a 7:3 ratio.

[0189] By employing the above methods, not only is the accuracy and consistency of the data improved, but rich semantic information is also provided for model training, thereby enhancing the model's ability to identify and detect network attacks, effectively improving the intelligence level of network security protection and its ability to cope with complex attack scenarios.

[0190] In some implementations, to improve the performance of the large language model in specific cybersecurity tasks, a comprehensive task instruction set can be constructed by systematically generating and expanding seed instructions. A fine-tuning dataset is then generated based on these task instructions and the corresponding sample traffic detection results. This ensures that the second preset large language model can be finely trained for various network attack categories, thereby improving its understanding and recognition capabilities for complex attack behaviors. For example, before step 204, i.e., before "obtaining the second sample traffic to be detected, the corresponding sample traffic detection results, and multiple sample detection instructions corresponding to the second sample traffic to be detected from the preset fine-tuning dataset, and sequentially inputting the second sample traffic to be detected and each sample detection instruction into the second preset large language model to obtain the predicted traffic detection results," the following steps are also included:

[0191] (B.1) Obtain multiple preset instruction types;

[0192] (B.2) For each second sample of traffic to be detected, generate multiple seed instructions corresponding to various instruction types;

[0193] (B.3) Expand the task instruction corresponding to each seed instruction according to the preset multiple network attack categories to obtain multiple sample detection instructions corresponding to each second sample traffic to be detected under multiple network attack categories;

[0194] (B.4) Obtain the sample traffic detection result corresponding to each second sample to be detected traffic, and generate a fine-tuning dataset based on multiple second sample to be detected traffic, multiple corresponding sample detection instructions, and multiple corresponding sample traffic detection results.

[0195] The instruction type can be attack type classification, attack payload feature identification, attack entity information identification, etc.

[0196] The network attack categories can be different types of network attacks, such as injection attacks, cross-site scripting attacks, vulnerability exploitation attacks, protocol layer attacks, and so on. Each network attack category represents a specific attack pattern or method, used to classify and label related network traffic data.

[0197] Seed instructions can be basic instruction templates generated in attack detection scenarios based on instruction types. They can include descriptions of specific attack patterns, requirements for identifying attack traffic characteristics, and classification needs for attack behaviors. For example, seed instructions can contain basic phrases such as "Analyze the following HTTP requests to determine the attack type".

[0198] The task instructions can be diverse instructions formed by extending seed instructions through a self-guided method. For example, multiple task instructions can be generated for the same traffic, posing questions from the perspectives of attack type classification, payload feature recognition, and entity information recognition, enabling the model to perform comprehensive and in-depth learning and understanding.

[0199] For example, multiple seed instructions can be generated for each second sample of traffic to be detected, based on the instruction type. Taking SQL injection attack as an example, the seed instructions can be attack type classification instructions: "Identify whether this traffic is an SQL injection attack", attack payload feature identification instructions: "Extract SQL injection features from this traffic, such as 'OR1=1'", attack entity information identification instructions: "Identify the attacker's IP address and target URL in this traffic", and so on.

[0200] In some implementations, common attack detection scenarios can be identified first, and the network attack categories for attack detection tasks can be defined based on these scenarios. Task ranges can then be set for each task, such as dividing tasks into sub-tasks like attack type classification, attack payload feature identification, attack method identification, abnormal traffic detection, and attack behavior interpretation. Each network attack category can be further refined; for example, SQL injection attacks can be further divided into Boolean-based blind injection, time-based blind injection, union query injection, error-based injection, and so on.

[0201] In some implementations, the task instructions corresponding to each network attack category can be expanded based on the seed instruction. For example, for the second sample traffic to be detected, 'a', the corresponding seed instruction could be to identify whether the second sample traffic to be detected, 'a', is attack traffic. After expanding from multiple dimensions such as attack type classification, attack payload feature identification, attack method identification, abnormal traffic detection, and attack behavior interpretation, multiple sample detection instructions corresponding to the second sample traffic to be detected, 'a', can be obtained. Furthermore, the seed instruction and the corresponding sample detection instructions can be generated using large language models, such as GPT-3.5 and GPT-4.

[0202] In some implementations, the attack type classification instruction for the seed command can be "Determine whether the following HTTP request belongs to SQL injection: GET / search?q=1'AND(SELECT *FROM users)--HTTP / 1.1"; the attack payload feature identification instruction can be "Extract abnormal parameters from the following payload: username=admin'UNIONSELECT1,@@version,3--"; the attack entity information identification instruction can be "Identify the attacker IP and vulnerable parameters in the following log: 2023-05-01 14:22 [XSS] Source IP:10.0.0.5 Request path: / comment?content= <script>...< / script> The above is just an example; specific seed commands can be set according to actual conditions, and this application does not impose many restrictions on them.

[0203] Furthermore, regular expressions can be used to automatically extract key fields from each second sample of traffic to be detected, which can help expand the sample detection instructions for the second sample of traffic to be detected under various seed instructions.

[0204] In some implementations, seed instructions can undergo instruction complexity upgrade processing, cross-task combination processing, and defense correlation processing, thereby expanding corresponding task instructions based on the seed instructions to obtain multiple sample detection instructions. Specifically, instruction complexity upgrade processing can upgrade a single classification task into a multi-step inference task. For example, if the seed instruction is "determine if it is SQL injection," the expansion can yield at least one task instruction, such as "analyze whether the following request parameters have time-based blind injection characteristics and explain the basis for judgment." Cross-task combination processing can fuse classification and feature categories. For example, the expanded task instruction could be "identify the payload type (reflected / stored) of this XSS attack and extract dangerous functions from the malicious script." Defense correlation processing can generate remediation suggestions based on attack characteristics. For example, the expanded task instruction could be "generate three defense schemes for the detected XXE attack, requiring modifications to the XML parser configuration."

[0205] For example, the original seed instruction could be "determine whether the following request is an SQL injection attack", and the corresponding second sample traffic to be detected could be "GET / product?id=1' OR 1=1--". Then, after generating multiple sample detection instructions corresponding to the second sample traffic based on the seed instruction, the following sample detection instructions can be obtained:

[0206] Analyze the logical structure in the request parameters to determine whether the SQL injection attack is a union query injection, boolean blind injection, or tautology injection? (The corresponding sample traffic detection result is "tautology injection, bypassing authentication by constructing tautology logic through 1'OR1=1").

[0207] Identify the SQL injection payload characteristics in the following requests, including closure characters, logical operators, and comment characters, and explain their functions. (The corresponding sample traffic detection results are: "1. Closure character: Single quote (') is used to close the original query parameters; 2. Logical operator: OR1=1 constructs a always true condition; 3. Comment character: -- is used to truncate subsequent query statements");

[0208] Assuming the request targets the user login interface, infer the attacker's intent and the data types that might be leaked. (The corresponding sample traffic detection result is "Attack intent: bypass authentication; potentially leaked data: user table username / password").

[0209] The above are merely examples. In practice, seed instructions can be expanded through multiple instruction dimensions. For instance, these dimensions could include attack subclass classification instructions, attack feature recognition instructions, attack context association instructions, defense suggestion generation instructions, attack impact assessment instructions, composite task instructions, attack variant detection instructions, and so on. Expanding seed instructions across these multiple dimensions can cover the entire attack detection process, enhancing the model's understanding and recognition of different attack patterns during training.

[0210] For example, each second sample traffic to be detected can be associated with multiple sample detection commands (e.g., 10 to 20), and each sample detection command corresponds to a sample traffic detection result. Then, a data triplet is generated based on each second sample traffic to be detected, the corresponding associated sample detection command, and the corresponding associated sample traffic detection result. Subsequently, a fine-tuning dataset is generated based on multiple data triplets.

[0211] The fine-tuning dataset generated in the above manner provides rich attack scenario coverage for model training, enabling the large language model to accurately learn the complex features and potential correlations of network attacks. At the same time, it facilitates the subsequent large language model to accurately understand instructions and give correct detection results.

[0212] In some implementations, to improve the accuracy of network attack identification and risk assessment, feature extraction and structuring of traffic detection results can be performed, and these results can be mapped to a pre-defined security knowledge base to determine corresponding vulnerability entries and their threat levels, ultimately generating targeted solutions. This effectively enhances overall network security protection capabilities. For example, after step 102, i.e., after "inputting the traffic to be detected and the detection command into the large language model to obtain the traffic detection results corresponding to the traffic to be detected," the following may also be included:

[0213] (C.1) Obtain the preset vulnerability classification, extract features from the traffic detection results, and obtain the corresponding structured data of attack features;

[0214] (C.2) Obtain the preset security knowledge base, map the structured data in the security knowledge base, and determine the vulnerability entries and threat levels corresponding to the structured data;

[0215] (C.3) Generate corresponding handling solutions based on the vulnerability entries and threat levels corresponding to the traffic detection results.

[0216] Vulnerability classification can be a systematic categorization of known security vulnerabilities, such as OWASP Top 10 or CWE (Common Weakness Enumeration). Each category represents a specific type of security problem or weakness, which is convenient for identification and management.

[0217] Attack signatures can be specific identifiers or patterns extracted from traffic detection results, used to describe key characteristics of attack behavior. For example, in an SQL injection attack, these might include specific SQL syntax or unusual packet sizes.

[0218] Structured data, in this context, refers to the transformation of raw traffic detection results into a standardized, easily parsed, and processed data format. It typically includes information such as field names, types, and values, enabling efficient data processing by computer programs.

[0219] The security knowledge base can be a database or knowledge system containing information such as various known security vulnerabilities, their detailed descriptions, ratings, and solutions, such as OWASP and CWE, for models to compare and map.

[0220] Among them, vulnerability entries can be specific records in the security knowledge base, describing detailed information about a particular vulnerability, including its name, description, scope of impact, and remediation recommendations.

[0221] Threat level can be a risk assessment level based on factors such as the potential harm and exploitability of vulnerabilities. It is generally divided into three levels: high, medium and low, to help security teams prioritize the most urgent issues.

[0222] The handling solutions can be specific response strategies or operational guidelines generated based on vulnerability entries and their threat levels, aiming to guide security teams to take appropriate defensive measures to mitigate or eliminate threats. For example, for SQL injection attacks, the handling solutions might include suggestions such as implementing input validation and parameterized queries.

[0223] For example, when a traffic detection result corresponding to an HTTP POST request is detected, structured data of the corresponding attack characteristics can be extracted from the traffic detection result or the traffic to be detected according to a preset vulnerability classification. For example, the vulnerability classification can be attack type label, confidence value, attack vector, attack payload characteristics, abnormal operator combination, timestamp, etc. For example, the attack type label can be "SQL_Injection", the confidence value can be 0.98, and the attack vector can be a POST request of the " / user / login" interface; the attack payload characteristics are parsed, the abnormal operator combination in the parameter "username=admin'OR 1=1--" is extracted, and the feature pattern containing the logical operator "OR", the always true condition "1=1" and the SQL comment character "--" is identified; the context metadata is extracted, including the source IP (192.168.1.105), the target port (443), the protocol type (HTTPS), and the timestamp (2025-03-15T14:22:35+08:00), and the above structured data is mapped in the security knowledge base.

[0224] Furthermore, the structured data described above can be matched with the CWE knowledge base. For example, the semantic matching engine of the CWE knowledge base can be used to establish a strong association between the "SQL_Injection" attack type and the vulnerability entry CWE-89 (neutralization error of special elements used in SQL commands), while also associating it with the vulnerability entry CWE-943 (missing data neutralization in data query logic).

[0225] Furthermore, based on the OWASP Top 10-2021 classification standard, traffic detection results can be mapped to the A03:2021 (injection vulnerability) category to extract corresponding risk characteristics. For example, risk characteristics could include: Attack complexity: low (exploitable without authentication), Potential impact: high risk (potentially leading to complete database breach), and Lack of defense mechanisms: no detection of parameterized query usage. Additionally, the model can automatically assess and determine the threat level corresponding to the traffic detection results; alternatively, the threat level can be determined by technical personnel.

[0226] For example, based on the vulnerability entries, risk characteristics, threat levels, etc., corresponding to the traffic detection results, corresponding handling solutions can be automatically generated. Specifically, the handling solutions can include a three-level response strategy, including immediate handling measures, remediation suggestions, and priority handling. For example, immediate handling measures can include dynamically inserting protection rules through WAF (e.g., blocking POST requests containing consecutive special characters ('--) in real time), activating request redirection mechanisms to direct attack traffic to the honeypot system for behavior tracking, etc. Furthermore, remediation suggestions can be code-level remediation suggestions (e.g., forcing the use of PreparedStatement at the DAO layer, implementing whitelist validation for user input, etc.), configuration-level remediation suggestions (e.g., adding SQLi feature regular expression filtering rules in Nginx configuration, etc.), and architecture-level remediation suggestions (e.g., recommending the deployment of a database firewall to implement SQL syntax tree analysis, etc.), etc.

[0227] Furthermore, prioritization measures may include generating critical security incident tickets, automatically pushing vulnerability details to relevant systems, and sending threat intelligence to the Security Operations Center (SOC) platform, among other things.

[0228] By using the above methods, attack characteristics can be extracted quickly and accurately, and their corresponding vulnerability entries and threat levels can be determined. This not only improves the efficiency of vulnerability identification and threat assessment, but also enhances the automation and intelligence of security operations, enabling security teams to respond to and handle high-risk security incidents more quickly, optimize security operation processes, and improve overall network security protection capabilities.

[0229] Please refer to Figure 4 The following is combined with Figure 4 The following describes the overall embodiments of this application. For example, 1 can capture and collect raw network traffic packets (PCAP files) from a network environment, and decode and reassemble the network traffic packets to extract key information such as HTTP requests and responses, and convert binary data into a readable text format.

[0230] Furthermore, data related to network attack detection can be collected from captured network traffic packets, such as attack payloads, normal traffic, attack traffic samples, and vulnerability code. The collected data can be cleaned and preprocessed, which may include removing irrelevant traffic, decoding TCP streams, extracting key HTTP information, and performing data deduplication and formatting to construct a high-quality pre-training dataset.

[0231] Furthermore, based on each second sample of traffic to be detected, multiple seed instructions corresponding to multiple network attack categories can be generated, and the seed instructions can be expanded to obtain multiple second sample traffic to be detected, multiple corresponding sample detection instructions, and multiple corresponding sample traffic detection results, thus generating a fine-tuning dataset.

[0232] Furthermore, based on the pre-trained dataset, the first preset large language model can be trained a second time to obtain a second preset large language model. This allows the model to fully learn traffic patterns, thereby improving the accuracy of network attack traffic detection. Then, the second preset large language model can be fine-tuned using a fine-tuning dataset to enable it to accurately align questions and answers, ultimately resulting in the large language model.

[0233] Furthermore, the traffic to be detected can be input into a large language model to obtain the corresponding traffic detection results. To improve the overall network security protection capability, the obtained traffic detection results can also be mapped to a security knowledge base to determine the corresponding vulnerability entries and threat levels. Based on the vulnerability entries and threat levels, specific handling solutions can be generated, including generating security incident tickets, pushing vulnerability details to relevant systems, and sending threat intelligence to the SOC platform, to provide detailed threat analysis and response recommendations.

[0234] Please see Figure 5 This application also provides a network attack traffic detection device, which can implement the above-described network attack traffic detection method. The network attack traffic detection device includes:

[0235] The acquisition module 51 is used to acquire the traffic to be detected and the detection instructions generated based on the traffic to be detected;

[0236] Input module 52 is used to input the traffic to be detected and the detection command into the large language model to obtain the traffic detection result corresponding to the traffic to be detected;

[0237] Among them, the large language model is trained by learning traffic patterns through the first preset large language model based on the first loss to obtain the second preset large language model, and is trained by the second preset large language model based on the second loss for instruction understanding.

[0238] The first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected. The predicted traffic to be detected is obtained by the first preset large language model based on the first sample traffic to be detected through recursive prediction.

[0239] The recursive prediction process is a recursive process of generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected, and predicting the next traffic feature based on the intermediate prediction sequence, so as to update the intermediate prediction sequence according to the next traffic feature.

[0240] The second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result.

[0241] The specific implementation of this network attack traffic detection device is basically the same as the specific embodiment of the network attack traffic detection method described above, and will not be repeated here. Subject to meeting the requirements of the embodiments of this application, the network attack traffic detection device may also be equipped with other functional modules to implement the network attack traffic detection method described above.

[0242] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned network attack traffic detection method. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0243] Please see Figure 6 , Figure 6 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0244] The processor 61 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0245] The memory 62 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 62 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 62 and called and executed by the processor 61 using the network attack traffic detection method of the embodiments of this application.

[0246] Input / output interface 63 is used to implement information input and output;

[0247] The communication interface 64 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0248] Bus 65 transmits information between various components of the device (e.g., processor 61, memory 62, input / output interface 63, and communication interface 64);

[0249] The processor 61, memory 62, input / output interface 63, and communication interface 64 are interconnected within the device via bus 65.

[0250] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described network attack traffic detection method.

[0251] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0252] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0253] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0254] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0255] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0256] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0257] It should be understood that in this application, "at least one" and "several" refer to one or more items, and "multiple" refers to two or more items. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions are any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0258] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0259] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0260] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0261] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0262] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for detecting network attack traffic, characterized in that, The method includes: Acquire the traffic to be detected, and the detection instructions generated based on the traffic to be detected; The traffic to be detected and the detection command are input into the large language model to obtain the traffic detection result corresponding to the traffic to be detected; The large language model is obtained by learning and training the flow pattern of the first preset large language model based on the first loss, and then training the second preset large language model based on the second loss to understand instructions. The first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected. The predicted traffic to be detected is obtained by the first preset large language model recursively predicting based on the first sample traffic to be detected. The recursive prediction process is a recursive process of generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the traffic to be detected in the first sample, predicting the next traffic feature based on the intermediate prediction sequence, and updating the intermediate prediction sequence according to the next traffic feature. The second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result. The large language model is trained as follows: A first sample of traffic to be detected is obtained from a pre-set pre-training dataset, and the first pre-set large language model is used to recursively predict the traffic based on the first sample of traffic to be detected to obtain a predicted traffic to be detected; a first loss is determined based on the difference between the first sample of traffic to be detected and the predicted traffic to be detected; the first pre-set large language model is trained based on the first loss to obtain a second pre-set large language model; a second sample of traffic to be detected, the corresponding sample traffic detection result, and multiple sample detection instructions corresponding to the second sample of traffic to be detected are obtained from a pre-set fine-tuning dataset, and the second sample of traffic to be detected and each sample detection instruction are sequentially input into the second pre-set large language model to obtain a predicted traffic detection result; a second loss is determined based on the difference between the predicted traffic detection result and the sample traffic detection result; the second pre-set large language model is fine-tuned based on the second loss to obtain a large language model. The first preset large language model recursively predicts the traffic to be detected based on the first sample traffic to be detected, and obtains the predicted traffic to be detected, including: generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected using the first preset large language model; predicting the next traffic feature for the next time step based on the intermediate prediction sequence, and updating the intermediate prediction sequence by ...

2. The network attack traffic detection method according to claim 1, characterized in that, The step of training the first preset large language model based on the first loss to obtain the second preset large language model includes: In the self-attention layer of the second preset large language model, a low-rank adaptation layer is added; The parameters of the low-rank adaptive layer are adjusted based on the second loss to obtain a large language model.

3. The network attack traffic detection method according to claim 1, characterized in that, Before obtaining the first sample traffic to be detected from the preset pre-trained dataset and recursively predicting the predicted traffic based on the first sample traffic using the first preset large language model, the method further includes: Acquire attack payload data, normal traffic data, attack traffic data, and vulnerability code data; The attack payload data, the normal traffic data, the attack traffic data, and the vulnerability code data are cleaned to obtain multiple initial sample data. Each initial sample data is labeled with multiple feature fields according to multiple preset classification fields to obtain the first sample traffic to be detected corresponding to each initial sample data. A pre-training dataset is constructed based on multiple first-sample traffic samples to be detected.

4. The network attack traffic detection method according to claim 1, characterized in that, Before obtaining the second sample traffic to be detected, the corresponding sample traffic detection result, and multiple sample detection instructions corresponding to the second sample traffic to be detected from the preset fine-tuning dataset, and sequentially inputting the second sample traffic to be detected and each sample detection instruction into the second preset large language model to obtain the predicted traffic detection result, the method further includes: Obtain multiple preset instruction types; For each second sample of traffic to be detected, generate multiple seed instructions corresponding to various instruction types; Expand the task instruction corresponding to each seed instruction according to multiple preset network attack categories to obtain multiple sample detection instructions corresponding to each second sample traffic to be detected under the multiple network attack categories; Obtain the sample traffic detection result corresponding to each second sample traffic to be detected, and generate a fine-tuning dataset based on multiple second sample traffic to be detected, multiple corresponding sample detection instructions, and multiple corresponding sample traffic detection results.

5. The network attack traffic detection method according to claim 1, characterized in that, After inputting the traffic to be detected and the detection command into the large language model to obtain the traffic detection result corresponding to the traffic to be detected, the method further includes: The traffic detection results are subjected to feature extraction based on the preset vulnerability classification to obtain structured data of the corresponding attack features; Obtain a preset security knowledge base, and map the structured data in the security knowledge base to determine the vulnerability entries and threat levels corresponding to the structured data; Based on the vulnerability entries and threat levels corresponding to the traffic detection results, a corresponding processing solution is generated.

6. A network attack traffic detection device, characterized in that, The device includes: The acquisition module is used to acquire the traffic to be detected and the detection instructions generated based on the traffic to be detected; The input module is used to input the traffic to be detected and the detection command into the large language model to obtain the traffic detection result corresponding to the traffic to be detected; The large language model is obtained by learning and training the flow pattern of the first preset large language model based on the first loss, and then training the second preset large language model based on the second loss to understand instructions. The first loss is determined by the first preset large language model based on the difference between the predicted traffic to be detected and the first sample traffic to be detected. The predicted traffic to be detected is obtained by the first preset large language model recursively predicting based on the first sample traffic to be detected. The recursive prediction process is a recursive process of generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the traffic to be detected in the first sample, predicting the next traffic feature based on the intermediate prediction sequence, and updating the intermediate prediction sequence according to the next traffic feature. The second loss is determined by the difference between the predicted traffic detection result output by the second preset large language model based on the second sample traffic to be detected and the sample traffic detection result. The large language model is trained as follows: A first sample of traffic to be detected is obtained from a pre-set pre-training dataset, and the first pre-set large language model is used to recursively predict the traffic based on the first sample of traffic to be detected to obtain a predicted traffic to be detected; a first loss is determined based on the difference between the first sample of traffic to be detected and the predicted traffic to be detected; the first pre-set large language model is trained based on the first loss to obtain a second pre-set large language model; a second sample of traffic to be detected, the corresponding sample traffic detection result, and multiple sample detection instructions corresponding to the second sample of traffic to be detected are obtained from a pre-set fine-tuning dataset, and the second sample of traffic to be detected and each sample detection instruction are sequentially input into the second pre-set large language model to obtain a predicted traffic detection result; a second loss is determined based on the difference between the predicted traffic detection result and the sample traffic detection result; the second pre-set large language model is fine-tuned based on the second loss to obtain a large language model. The first preset large language model recursively predicts the traffic to be detected based on the first sample traffic to be detected, and obtains the predicted traffic to be detected, including: generating an intermediate prediction sequence based on the first traffic feature corresponding to the first time step of the first sample traffic to be detected using the first preset large language model; predicting the next traffic feature for the next time step based on the intermediate prediction sequence, and updating the intermediate prediction sequence by ...

7. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the network attack traffic detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the network attack traffic detection method according to any one of claims 1 to 5.

Images