Cybersecurity task processing methods, devices, computer equipment, and readable storage media

Abstract

Embodiments of the present application provide a network security task processing method and device, computer equipment and a readable storage medium. A plurality of network security tasks are obtained and input into an inference layer of a large language model for parallel analysis to obtain corresponding detection results; for each detection result, a first inference snapshot is read, and an inference snapshot offset degree of the detection result is calculated based on the difference between the first inference snapshot and a second inference snapshot obtained through similarity retrieval; the confidence of each detection result is obtained, and when the inference snapshot offset degree is greater than a first threshold or the confidence is less than a second threshold, a fact inference result is obtained through fact inference on the detection result by a verification layer; the detection result and the fact inference result are input into a correction layer to obtain a correction instruction; each detection result, each network security task and the correction instruction are input into the inference layer to obtain a target detection result corresponding to each network security task. In this way, the accuracy of the network security task processing result can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network security task processing method, apparatus, computer equipment, and readable storage medium. Background Technology

[0002] Cybersecurity task processing is the process of identifying, analyzing, and responding to security events in the network environment through technical means. It involves key tasks such as threat classification, log parsing, attack attribution, and vulnerability assessment. Its core objective is to extract valuable information from massive amounts of log data, determine the types of potential threats, and thereby improve the efficiency and accuracy of cybersecurity protection.

[0003] In related technologies, a general-purpose large model (such as a cloud-based model like GPT-4) is typically used to process cybersecurity tasks through static prompting engineering. Specifically, the general-purpose large model can directly call the cloud-based Application Programming Interface (API) to generate response results based on the cybersecurity task (including static prompting information).

[0004] However, under a general static template, large language models often fail to effectively constrain the consistency between their inference logic and output, leading to a surge in illusion rates, inaccurate task predictions, and even cascading errors in multiple cybersecurity tasks. For example, minor deviations in the initial log parsing stage (such as misclassifying protocol types) can propagate to subsequent threat classification tasks (such as misclassifying normal traffic as a high-risk attack), causing errors to amplify layer by layer and ultimately resulting in inaccurate cybersecurity task processing results. Summary of the Invention

[0005] This application proposes a cybersecurity task processing method, apparatus, computer equipment, and readable storage medium, which can improve the accuracy of cybersecurity task processing results.

[0006] To achieve the above objectives, a first aspect of this application proposes a cybersecurity task processing method, the method comprising:

[0007] Multiple cybersecurity tasks are acquired and input into the inference layer of a large language model for parallel analysis to obtain the detection results corresponding to each cybersecurity task. The large language model includes an inference layer, a verification layer, and a correction layer.

[0008] For each detection result, a corresponding first inference snapshot is read. Based on the first inference snapshot, a similarity search is performed in a preset inference memory to obtain a corresponding second inference snapshot. Based on the difference between the first inference snapshot and the second inference snapshot, the inference snapshot offset corresponding to each detection result is calculated.

[0009] The confidence level of each detection result is obtained, and when the inference snapshot offset is greater than a first threshold or the confidence level is less than a second threshold, fact inference is performed on each detection result through the verification layer to obtain the fact inference result;

[0010] Each detection result and the factual reasoning result are input into the correction layer to correct the difference in reasoning results, thereby obtaining a correction instruction;

[0011] Each detection result, each cybersecurity task, and the correction instruction are input into the inference layer to obtain the target detection result corresponding to each cybersecurity task.

[0012] Accordingly, a second aspect of the embodiments of this application proposes a cybersecurity task processing device, the device comprising:

[0013] The acquisition module is used to acquire multiple cybersecurity tasks and input the multiple cybersecurity tasks into the inference layer of the large language model for parallel analysis to obtain the detection result corresponding to each cybersecurity task. The large language model includes an inference layer, a verification layer and a correction layer.

[0014] The calculation module is used to read the corresponding first inference snapshot for each detection result, perform similarity retrieval in a preset inference memory based on the first inference snapshot to obtain the corresponding second inference snapshot, and calculate the inference snapshot offset corresponding to each detection result based on the difference between the first inference snapshot and the second inference snapshot.

[0015] The inference module is used to obtain the confidence level of each detection result, and when the inference snapshot offset is greater than a first threshold or the confidence level is less than a second threshold, it performs fact inference on each detection result through the verification layer to obtain the fact inference result;

[0016] The correction module is used to input each detection result and the fact reasoning result into the correction layer to correct the difference in reasoning results and obtain correction instructions;

[0017] The input module is used to input each detection result, each cybersecurity task, and the correction instruction into the inference layer to obtain the target detection result corresponding to each cybersecurity task.

[0018] In some embodiments, the input module is further configured to:

[0019] Each detection result, each cybersecurity task, and the correction instruction are input into the inference layer to obtain intermediate detection results;

[0020] The updated inference snapshot offset and update confidence are calculated based on the intermediate detection results. When the updated inference snapshot offset is greater than the first threshold or the update confidence is less than the second threshold, the verification layer determines the updated fact inference result corresponding to the intermediate detection result. The correction layer generates an update correction instruction based on the intermediate detection result and the updated fact inference result. The inference layer generates an update detection result based on the intermediate detection result, each cybersecurity task, and the update correction instruction.

[0021] The process of repeatedly calculating the updated inference snapshot offset and update confidence based on the intermediate detection results, and determining the update fact inference result corresponding to the update detection result through the verification layer when the updated inference snapshot offset is greater than the first threshold or the update confidence is less than the second threshold, and generating an update correction instruction through the correction layer based on the update detection result and the update fact inference result, and generating an update detection result through the inference layer based on the update detection result, each cybersecurity task and the update correction instruction, continues until the updated inference snapshot offset is less than the first threshold and the update confidence is less than the second threshold, and the update detection result is used as the target detection result for each cybersecurity task.

[0022] In some embodiments, the input module is further configured to:

[0023] Based on each detection result and the correction instruction, multiple reasoning improvement steps are generated;

[0024] Each detection result, each cybersecurity task, the correction instruction, and the multiple inference improvement steps are input into the inference layer to obtain the target detection result.

[0025] In some embodiments, the acquisition module is further configured to:

[0026] The multiple cybersecurity tasks are input into the inference layer of the large language model, and for each cybersecurity task, the query information contained in each cybersecurity task is linearly transformed in parallel to obtain the corresponding query matrix.

[0027] Obtain the context reasoning information corresponding to each cybersecurity task, and perform a linear transformation on the context reasoning information to obtain the key matrix;

[0028] From each cybersecurity task, target knowledge information is extracted, and the target knowledge information is linearly transformed to obtain a value matrix;

[0029] Obtain a preset knowledge database, and search the knowledge database based on each cybersecurity task to obtain target knowledge base information;

[0030] Based on the target knowledge base information, a corresponding knowledge mask matrix is ​​generated;

[0031] Obtain the location masking matrix set for each cybersecurity task, and perform attention calculation on each cybersecurity task based on the query matrix, the key matrix, the value matrix, the knowledge mask matrix and the location masking matrix to obtain the corresponding detection result.

[0032] In some embodiments, the acquisition module is further configured to:

[0033] The first product is obtained by multiplying the query matrix and the transpose of the key matrix;

[0034] Obtain the key vector dimension corresponding to the key matrix, and obtain the first ratio based on the ratio between the first product and the key vector dimension;

[0035] The location masking matrix is ​​masked to obtain a masking result, and an attention matrix is ​​determined based on the sum of the masking result and the knowledge masking matrix.

[0036] The attention matrix is ​​logarithmically processed to obtain the processing result, and a second product is obtained based on the product between the processing result and the preset knowledge weight coefficients;

[0037] Based on the sum of the first ratio and the second product, knowledge-enhanced attention is obtained;

[0038] Based on the knowledge-enhanced attention, attention calculation is performed on the value matrix to obtain the corresponding detection results.

[0039] In some embodiments, the acquisition module is further configured to:

[0040] Multiple initial cybersecurity tasks are obtained, and each initial cybersecurity task is matched with a preset task category to determine the corresponding target task template, wherein the multiple initial cybersecurity tasks belong to different task categories;

[0041] The initial cybersecurity tasks are input into the corresponding target task templates to obtain multiple cybersecurity tasks.

[0042] In some embodiments, the cybersecurity task processing device further includes a storage module for:

[0043] Obtain multiple target inference snapshots corresponding to multiple target detection results;

[0044] The multiple target inference snapshots are stored in the inference memory.

[0045] Accordingly, a third aspect of the embodiments of this application proposes a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the cybersecurity task processing method of any one of the embodiments of the first aspect of this application.

[0046] Accordingly, a fourth aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the cybersecurity task processing method of any one of the embodiments of the first aspect of this application.

[0047] This application embodiment acquires multiple cybersecurity tasks and inputs them into the inference layer of a large language model for parallel analysis, obtaining detection results for each cybersecurity task. The large language model includes an inference layer, a verification layer, and a correction layer. For each detection result, a first inference snapshot is read, and a similarity search is performed in a preset inference memory based on the first inference snapshot to obtain a second inference snapshot. Based on the difference between the first and second inference snapshots, the inference snapshot offset for each detection result is calculated. The confidence level of each detection result is obtained, and when the inference snapshot offset is greater than a first threshold or the confidence level is less than a second threshold, factual inference is performed on each detection result through the verification layer to obtain a factual inference result. Each detection result and the factual inference result are input into the correction layer for inference result difference correction to obtain a correction instruction. Each detection result, each cybersecurity task, and the correction instruction are input into the inference layer to obtain the target detection result corresponding to each cybersecurity task. Thus, through dynamic multi-level verification and iterative correction, error detection, correction, and prevention of error propagation can be achieved. Specifically, parallel processing, rather than processing multiple cybersecurity tasks in multiple models or batches, fully utilizes the contextual information between tasks, supporting multi-dimensional correlation analysis within the same inference process, significantly enhancing logical consistency, inference efficiency, and result accuracy. Simultaneously, relying on dual threshold judgments of inference snapshot offset and confidence level to trigger structured verification and correction processes effectively curbs cascading errors caused by initial misjudgments and significantly reduces the incidence of illusions by constraining the inference path. In summary, this application can significantly enhance the accuracy, reliability, and robustness of cybersecurity analysis results while improving multi-task processing efficiency. Therefore, this application can improve the accuracy of cybersecurity task processing results. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the architecture of the cybersecurity task processing system provided in the embodiments of this application;

[0049] Figure 2 This is a flowchart of the cybersecurity task processing method provided in the embodiments of this application;

[0050] Figure 3 This is a schematic diagram of the task template provided in the embodiments of this application;

[0051] Figure 4 This is a schematic diagram of the functional modules of the cybersecurity task processing device provided in the embodiments of this application;

[0052] Figure 5 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0056] Cybersecurity task processing is the process of identifying, analyzing, and responding to security events in the network environment through technical means. It involves key tasks such as threat classification, log parsing, attack attribution, and vulnerability assessment. Its core objective is to extract valuable information from massive amounts of log data, determine the types of potential threats, and thereby improve the efficiency and accuracy of cybersecurity protection.

[0057] In related technologies, a general-purpose large model (such as a cloud-based model like GPT-4) is typically used to process cybersecurity tasks through static prompting engineering. Specifically, the general-purpose large model can directly call the cloud-based Application Programming Interface (API) to generate response results based on the cybersecurity task (including static prompting information).

[0058] However, under a general static template, large language models often fail to effectively constrain the consistency between their inference logic and output, leading to a surge in illusion rates, inaccurate task predictions, and even cascading errors in multiple cybersecurity tasks. For example, minor deviations in the initial log parsing stage (such as misclassifying protocol types) can propagate to subsequent threat classification tasks (such as misclassifying normal traffic as a high-risk attack), causing errors to amplify layer by layer and ultimately resulting in inaccurate cybersecurity task processing results.

[0059] Based on this, embodiments of this application provide a cybersecurity task processing method, apparatus, computer equipment, and readable storage medium, which can improve the accuracy of cybersecurity task processing results.

[0060] The cybersecurity task processing method, apparatus, computer equipment, and readable storage medium provided in this application are specifically described through the following embodiments. First, the cybersecurity task processing system in this application embodiment is described.

[0061] Please refer to Figure 1 In some implementations, this application provides a cybersecurity task processing system, including a terminal 11 and a server 12.

[0062] In some implementations, terminal 11 can be used to collect network security logs, user query inputs, preprocess and upload raw network security logs and event data. It can be a security gateway deployed on the enterprise intranet, an embedded probe device or a host with a security agent installed, etc.

[0063] Furthermore, terminal 11 can perform preliminary cleaning, format standardization, and sensitive information desensitization on the raw logs, and send the structured query to server 12 to achieve lightweight front-end processing and secure data isolation, reduce the processing load on server 12, and ensure data transmission security.

[0064] In some implementations, server 12 can be used to run large language models and provide multi-task collaborative reasoning and iterative reflection services. It can be a cloud computing server equipped with a high-performance graphics processing unit (GPU), a dedicated AI computing power cluster, or a distributed network security analysis platform. Server 12 can perform multi-task parallel analysis and self-reflection correction based on the data uploaded by the terminal, such as threat classification, log parsing, and vulnerability assessment, to output highly reliable target detection results.

[0065] Furthermore, terminal 11 and server 12 can interact and transmit commands through encrypted communication protocols (such as HTTPS and TLS). Terminal 11 is responsible for raw data collection and lightweight preprocessing, while server 12 undertakes centralized model reasoning and complex decision-making tasks, realizes the uploading of query requests and the return of multi-task reasoning results, and completes end-to-end collaborative security decision-making.

[0066] The cybersecurity task processing method in this application can be illustrated through the following embodiments.

[0067] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user will be obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent will the necessary user-related data for the normal operation of the embodiments of this application be obtained.

[0068] In this embodiment, the description will focus on the cybersecurity task processing device, which can be integrated into a computer device. See also... Figure 2 , Figure 2 This is a flowchart illustrating the steps of the cybersecurity task processing method provided in this application embodiment. Taking the cybersecurity task processing device specifically integrated into a terminal or server as an example, the specific process when the processor on the terminal or server executes the program instructions corresponding to the cybersecurity task processing method is as follows:

[0069] Step 101: Obtain multiple cybersecurity tasks and input them into the inference layer of the large language model for parallel analysis to obtain the detection results corresponding to each cybersecurity task. The large language model includes an inference layer, a verification layer, and a correction layer.

[0070] In some implementations, in order to achieve efficient collaborative processing of multiple cybersecurity tasks, multiple cybersecurity tasks can be input into the inference layer of a large language model for parallel analysis to quickly generate task results and reduce the latency of a serial architecture.

[0071] Multiple cybersecurity tasks can be collaborative tasks across various cybersecurity domains. These tasks are text generation paradigms uniformly transformed from the initial cybersecurity task using predefined templates. The task categories for these multiple cybersecurity tasks can include threat classification, log parsing, vulnerability assessment, etc.

[0072] Among them, a large language model can be a general-purpose large model with a pre-designed three-layer architecture of inference layer, correction layer, and verification layer. For example, a large language model can be a generative pre-trained transform model (GPT), a variant model of bidirectional encoder representations from transformers (BERT), and so on.

[0073] The inference layer can be used to generate an initial response (i.e., detection result) based on the current cybersecurity task, such as outputting port parsing results based on the input "this log [192.168.1.1:8080] corresponds to [ENTITY]".

[0074] The detection result can be the initial response rt output by the inference layer (such as the list of IP addresses obtained from log parsing), which may contain risks of insufficient confidence or excessive novelty, requiring subsequent verification and correction processes.

[0075] The verification layer can be a component based on an external knowledge base (such as the MITRE ATT&CK knowledge graph) to check response consistency and output credibility guarantees. For example, it can be used to compare the compliance level of the inference layer's detection results with the ATT&CK knowledge base.

[0076] The correction layer can be used to iteratively optimize inference layer errors through language-based instructions and generate correction prompts.

[0077] In some implementations, initial cybersecurity tasks such as threat classification, log parsing, and vulnerability assessment can be obtained and converted into a unified text format using predefined templates to generate multiple cybersecurity tasks. For example, when the initial cybersecurity task is a log parsing task, after filling in the corresponding template, the following cybersecurity tasks can be obtained:

[0078] T(x) = "This log [192.168.1.1:8080] corresponds to [ENTITY]", where [ENTITY] is the IP / port entity to be generated.

[0079] Where T(x) is the template function, and x is the initial cybersecurity task, which is the preprocessed log fragment.

[0080] Furthermore, multiple cybersecurity tasks obtained through padding can be input into the inference layer of the large language model to obtain the detection results of multiple cybersecurity tasks, such as the classification label corresponding to "port scanning".

[0081] In some implementations, a parallel association index can be designed between multiple cybersecurity tasks. Specifically, this can be achieved by calculating a joint semantic fingerprint of the core entities (such as IP address and attack type) and the task type for each cybersecurity task. , The joint semantic fingerprint corresponding to each cybersecurity task is mapped to a spatiotemporal coordinate grid.

[0082] Furthermore, the X-axis in the spatiotemporal coordinate network can represent the task type, and the Y-axis can represent the risk level. Therefore, for each cybersecurity task, the Manhattan distance between it and other cybersecurity tasks can be automatically retrieved using the spatiotemporal coordinate network. When the Manhattan distance between it and other cybersecurity tasks is less than a distance threshold, such as less than 3, a dynamic parallel association index is established between the joint semantic fingerprint of other cybersecurity tasks and the current cybersecurity task. Subsequently, when analyzing the current cybersecurity task, the joint semantic fingerprints of other cybersecurity tasks stored in the index can be automatically retrieved based on the parallel association index. This allows for potential association across task contexts (such as associating historical port scanning strategies with the current log parsing task), avoiding fragmentation between tasks.

[0083] The above methods allow for the parallel processing of multiple cybersecurity tasks, avoiding task fragmentation and response delays caused by using different models for different types of cybersecurity tasks. This improves the efficiency of cybersecurity task processing and facilitates subsequent analysis of detection results.

[0084] In some implementations, to prevent the model from generating illusions or engaging in unrealistic reasoning, an attention mechanism can be used to proactively, dynamically, and compulsively integrate structured knowledge associated with cybersecurity tasks into the reasoning process of the large language model. This allows the free reasoning of the large language model to be quickly anchored to credible domain knowledge constraints, forcing the model to focus on effective associations and achieving dynamic alignment between the response and the cybersecurity knowledge graph. For example, step 101, "inputting multiple cybersecurity tasks into the reasoning layer of the large language model for parallel analysis to obtain the detection results corresponding to each cybersecurity task," may further include:

[0085] (101.a1) Input multiple cybersecurity tasks into the inference layer of the large language model, and perform a linear transformation on the query information contained in each cybersecurity task in parallel to obtain the corresponding query matrix.

[0086] (101.a2) Obtain the context reasoning information corresponding to each cybersecurity task, and perform a linear transformation on the context reasoning information to obtain the key matrix;

[0087] (101.a3) Extract target knowledge information from each cybersecurity task, and perform a linear transformation on the target knowledge information to obtain a value matrix;

[0088] (101.a4) Obtain the preset knowledge database, and search the knowledge database based on each cybersecurity task to obtain the target knowledge base information;

[0089] (101.a5) Generate the corresponding knowledge mask matrix based on the target knowledge base information;

[0090] (101.a6) Obtain the location masking matrix set for each cybersecurity task, and perform attention calculation for each cybersecurity task based on the query matrix, key matrix, value matrix, knowledge mask matrix and location masking matrix to obtain the corresponding detection results.

[0091] The query matrix can be a matrix obtained from the task query information (i.e., the cybersecurity task) through linear transformation (such as a fully connected layer), used to represent the vectorized query features of the current task, such as the embedding vector of "behavior" in a threat classification task.

[0092] Among them, contextual reasoning information can be a combination of historical responses and current environmental states to provide reasoning background, such as the detection results and correction instructions of the previous round, which can be obtained in real time through task input; contextual reasoning information can also include other cybersecurity tasks that are input into the large language model in parallel, so that the large language model can quickly understand the current cybersecurity task.

[0093] The key matrix can be a matrix obtained from contextual reasoning information through linear transformation, used to calculate the attention relevance with the query matrix, such as a key vector representing the historical log parsing results, to evaluate the contextual association weight.

[0094] The target knowledge information can be structured knowledge fragments (such as IP addresses or vulnerability IDs in logs) extracted from the original input of the task, used as the raw data to generate the value matrix. For example, the target knowledge information could be port numbers extracted from logs using regular expressions.

[0095] The value matrix can be a matrix obtained from the target knowledge information through linear transformation, used to provide semantic content for response generation in the attention mechanism, such as feature representation of vulnerability risk level.

[0096] The knowledge database can be a pre-defined external structured knowledge base, such as the MITRE ATT&CK knowledge graph, used to store authoritative rules and entity relationships in the cybersecurity field. Data in the knowledge database can be retrieved in real time via an Application Programming Interface (API).

[0097] The target knowledge base information can be a subset of tasks related to the cybersecurity task retrieved from a knowledge database based on the target knowledge information of the cybersecurity task. For example, the target knowledge base information can be protocol rules matched for log parsing tasks, which can be used to constrain the scope of model inference. Alternatively, the target knowledge base information can be attack patterns associated with the IP address of the current cybersecurity task.

[0098] The knowledge mask matrix can be a logical matrix generated from the target knowledge base information. It can be used to highlight the location of effective knowledge and to weight key knowledge entities (such as port categories) in the Softmax calculation.

[0099] The position masking matrix can be used in attention mechanisms to force large language models to ignore regions that are off-limits. By setting an infinitely large value in the position masking matrix, invalid or irrelevant positions (such as unrelated protocol fields) can be masked.

[0100] In some implementations, after inputting multiple cybersecurity tasks (such as threat classification and log parsing) into the inference layer, the query information contained in each cybersecurity task (such as "this log [192.168.1.1:8080] corresponds to [ENTITY]") is processed through a preset weight matrix ( ), and perform a linear transformation to generate the query matrix Q.

[0101] Furthermore, contextual reasoning information for each task can be obtained through a pre-defined weight matrix ( A linear transformation is performed to generate a key matrix K, which can be used to represent contextual features. Then, target knowledge information (such as IP addresses and protocol types in logs) can be extracted from the cybersecurity task and weighted using a pre-defined weight matrix. A linear transformation is performed to generate a value matrix V, which can be used to provide the semantic content of the response generation.

[0102] Furthermore, similarity matching can be performed in a pre-defined knowledge database using cybersecurity tasks. When the similarity score is greater than a similarity threshold, such as greater than 0.8, the relevant content is retrieved as the target knowledge base information. Then, the target knowledge base information is mapped to a knowledge mask matrix, with key knowledge locations in the knowledge mask matrix assigned a value of 1 and the rest set to 0. Simultaneously, a pre-defined location masking matrix is ​​obtained, which can be used to mask invalid locations, such as non-IP fields.

[0103] Therefore, attention can be calculated for each cybersecurity task based on the query matrix, key matrix, value matrix, knowledge mask matrix, and location mask matrix. The specific calculation process is as follows:

[0104] ;

[0105] in, For query matrix; It is the transpose of the key matrix; It is a value matrix; For knowledge mask matrix; For location masking matrix; The dimension of the key vector; This refers to the knowledge weighting coefficient. It can be a normalized probability function, used to convert any real vector into a probability distribution.

[0106] In some implementations, attention calculations can be used to obtain the corresponding output vector, and the large language model can output the detection result corresponding to the current cybersecurity task based on this output vector.

[0107] In some implementations, model parameters can be dynamically allocated using a lightweight adapter. For example, more attention heads can be allocated to high-priority tasks (such as APT detection), and the aforementioned knowledge weight coefficients can be used. The knowledge weight coefficient is increased to 1.2 to strengthen knowledge constraints; while for low-priority tasks (such as log keyword extraction), sparse computation paths can be used, and the aforementioned knowledge weight coefficients are adjusted accordingly. Increase it to 0.7, etc., to effectively reduce the number of parameters.

[0108] By performing knowledge anchoring computation in parallel for each cybersecurity task, dynamic knowledge constraints can be seamlessly integrated into the attention mechanism. This can be combined with highly reliable input of domain knowledge to ensure inference consistency, significantly reduce the illusion rate of the detection results output by the model, and facilitate subsequent verification and correction layers to perform dynamic iterative optimization based on highly reliable detection results (such as triggering verification and correction processes).

[0109] In some implementations, to dynamically embed domain knowledge into the attention mechanism and optimize the inference accuracy and reliability of large models in complex cybersecurity tasks, attention calculations can be performed on each cybersecurity task using the attention mechanism. This addresses the illusion problem and decision bias caused by unreasonable attention allocation in multi-task processing of large cybersecurity models. For example, the phrase "based on the query matrix, key matrix, value matrix, knowledge mask matrix, and location mask matrix, perform attention calculations on each cybersecurity task to obtain the corresponding detection results" in (101.a6) can include:

[0110] (101.a6.1) The first product is obtained by multiplying the query matrix and the transpose of the key matrix;

[0111] (101.a6.2) Obtain the dimension of the key vector corresponding to the key matrix, and obtain the first ratio based on the ratio between the first product and the dimension of the key vector;

[0112] (101.a6.3) Perform masking processing on the position masking matrix to obtain the masking result, and determine the attention matrix based on the sum of the masking result and the knowledge masking matrix;

[0113] (101.a6.4) Perform logarithmic processing on the attention matrix to obtain the processing result, and obtain the second product based on the product between the processing result and the preset knowledge weight coefficients;

[0114] (101.a6.5) Based on the sum of the first ratio and the second product, knowledge-enhanced attention is obtained;

[0115] (101.a6.6) Based on knowledge-enhanced attention, attention is calculated on the value matrix to obtain the corresponding detection results.

[0116] The transpose of the key matrix can be the result of the linear algebraic transpose of the key matrix, used to calculate the association weight with the query matrix Q.

[0117] The first product can be the dot product of the query matrix Q and the transpose of the key matrix, used to characterize the semantic relevance between tasks, such as the matching degree matrix between behavioral descriptions and historical responses in a threat classification task.

[0118] The dimension of the key vector can be the feature dimension of the key matrix K. (e.g., 768-dimensional), through This allows scaling of the first product to prevent the dot product result from becoming too large and causing the Softmax gradient to vanish.

[0119] The first ratio can be a scaled first product used to stabilize the initial relevance calculation; for example, it can normalize the similarity score of the log parsing task.

[0120] The masking result can be obtained through a position masking matrix. The generated infinitely large masking entries are used to forcibly cover invalid locations (such as irrelevant protocol fields), for example, to mask entities that are not IP addresses in a knowledge graph.

[0121] The attention matrix can be a knowledge mask matrix. The logarithmic transformation of the sum of the masking results can constrain the distribution of attention by highlighting the effective knowledge locations.

[0122] The processing result can be a numerical scaling result of the attention matrix (such as direct output after logarithmic transformation), which is used to balance knowledge weights. For example, it can be used to compress the mask value of vulnerability risk level to a reasonable range.

[0123] The second product can be the product of the processing result and the knowledge weight coefficient, which can be used to control the influence strength of domain knowledge.

[0124] Among them, knowledge-enhanced attention can be the sum of the first ratio and the second product. After normalizing the knowledge-enhanced attention with Softmax, the weighted matrix V can achieve accurate knowledge anchoring.

[0125] In some implementations, it can be based on a query matrix. transpose of the key matrix Perform matrix multiplication to obtain the first product. Next, obtain the key matrix. Corresponding key vector dimension (Typically the hidden layer dimension of the model, such as 768), calculate the first ratio. Therefore, scaling can be used to avoid the Softmax gradient from disappearing due to an excessively large dot product result.

[0126] Furthermore, this can be achieved by adjusting the position masking matrix. To perform a masking process, the specified location is set to negative infinity, resulting in the masking effect. Then combine it with the knowledge mask matrix (Generated by mapping search results from a knowledge database) After adding them together and performing logarithmic calculations, the attention matrix can be obtained. .

[0127] Understandably, in order to effectively enhance the difference in knowledge weights, the attention matrix can be logarithmically processed to obtain the result. Then the processing result is compared with the preset knowledge weight coefficient. (For example, it can be set to 0.8) Multiply them to get the second product. .

[0128] Furthermore, the first ratio and the second product can be added to obtain the knowledge-enhanced attention. After performing Softmax normalization on the knowledge-enhanced attention and weighting the matrix V, the following context vector containing rich feature representations is finally obtained. :

[0129] ;

[0130] in, For query matrix; It is the transpose of the key matrix; It is a value matrix; For knowledge mask matrix; For location masking matrix; The dimension of the key vector; This represents the knowledge weighting coefficient.

[0131] Furthermore, the detection results corresponding to the cybersecurity task can be obtained by mapping the context vector to the category space.

[0132] The above methods effectively integrate domain knowledge constraints into the attention mechanism. In this process, domain knowledge (such as ATT&CK tactics and vulnerability databases) can be dynamically embedded into the attention mechanism by calculating the query-key matrix product and dimensionality ratio, combined with the position masking matrix and knowledge masking matrix. This forces the model to focus on key related information, suppresses the generation of irrelevant or erroneous associations, and reduces the risk of illusion. Simultaneously, by multiplying numerical scaling and preset knowledge weight coefficients, the contribution of the model's original attention and domain knowledge can be effectively balanced, avoiding over-reliance on a single signal (such as pure text features) and improving decision robustness. Finally, combining the ratio information with the knowledge-guided attention results, the final detection result can significantly improve logical consistency and reasoning credibility. In summary, the above methods, through the collaborative design of matrix operations and knowledge masks, dynamically optimize attention allocation and enhance the model's accuracy and anti-interference capabilities in complex cybersecurity scenarios.

[0133] In some implementations, to achieve unified modeling and efficient parallel processing of heterogeneous cybersecurity tasks, initial tasks such as threat classification and log parsing can be matched with preset task categories, and corresponding target task templates can be dynamically populated to transform the raw input into standardized text generation tasks. This eliminates redundancy in multi-model deployment and achieves end-to-end processing. For example, "obtaining multiple cybersecurity tasks" in step 101 may include:

[0134] (101.b1) Obtain multiple initial cybersecurity tasks and match each initial cybersecurity task with a preset task category to determine the corresponding target task template, wherein the multiple initial cybersecurity tasks belong to different task categories;

[0135] (101.b2) Input multiple initial cybersecurity tasks into the corresponding multiple target task templates to obtain multiple cybersecurity tasks.

[0136] Among them, multiple initial cybersecurity tasks can be multiple original security event subtasks that need to be processed independently, such as log parsing, threat classification, vulnerability assessment, etc. They can be obtained in real time through user input or system collection. For example, an initial cybersecurity task can be a port scanning behavior analysis requirement extracted from security logs.

[0137] The target task template can be a pre-defined standardized text generation instruction, which can be adapted to different tasks by filling and replacing placeholders (such as replacing [LOG] with specific log content), and can be used to unify the input format of large models.

[0138] The task category can be a predefined classification label for cybersecurity tasks, such as threat classification, log parsing, vulnerability assessment, etc., and can be divided according to functional characteristics.

[0139] Please refer to Figure 3 In some implementations, multiple initial cybersecurity tasks can be obtained. For example, initial cybersecurity task 1 is "detecting abnormal connections to 192.168.1.1:8080", and initial cybersecurity task 2 is "analyzing the risk level of CVE-2023-1234". Then, a keyword matching algorithm can be used to match each initial cybersecurity task with a preset task category. For example, when the task description contains keywords such as "behavior" or "attack", it can be matched to the threat classification category; when it contains keywords such as "log" or "parsing", it can be matched to the log parsing category; and when it contains keywords such as "vulnerability" or "CVE", it can be matched to the vulnerability assessment category. Thus, the target task template corresponding to each initial cybersecurity task can be determined.

[0140] For example, according to Figure 3 (For example only) The target task template for determining the threat classification can be "This behavior [BEHAVIOR] belongs to [THREAT]", the target task template for log parsing can be "This log [LOG] corresponds to [ENTITY]", and the target task template for vulnerability assessment can be "This vulnerability [CVE] has a risk level of [LEVEL]".

[0141] Furthermore, multiple initial cybersecurity tasks can be input into corresponding target task templates for population processing. Specifically, key information can be extracted from the initial tasks and used to replace placeholders in the target task templates to obtain standardized cybersecurity tasks. For example, "192.168.1.1:8080" can be extracted from "detecting abnormal connections to 192.168.1.1:8080" as the [LOG] value, and used to replace the placeholders in the target task templates to obtain standardized cybersecurity tasks, such as "this log [192.168.1.1:8080] corresponds to [ENTITY]", where the placeholders [BEHAVIOR] / [LOG] / [CVE] come from keywords extracted from the initial task text through entity recognition, and [THREAT] / [ENTITY] / [LEVEL] are the targets to be inferred by the large language model.

[0142] By using the above methods, heterogeneous tasks can be transformed into a unified text paradigm, and the output space can be standardized through template constraints to reduce the risk of model illusion. At the same time, it can facilitate parallel batch processing in the subsequent large language model inference layer, improving the efficiency of multi-task analysis.

[0143] Step 102: For each detection result, read the corresponding first inference snapshot, perform similarity retrieval in the preset inference memory based on the first inference snapshot to obtain the corresponding second inference snapshot, and calculate the inference snapshot offset corresponding to each detection result based on the difference between the first inference snapshot and the second inference snapshot.

[0144] In some implementations, to avoid unnecessary computation for routine tasks and achieve a balance between efficiency and accuracy, the novelty risk of the detection results (inference snapshot offset) can be quantified by comparing the difference between the current task inference process (first inference snapshot) and historical experience (second inference snapshot). This allows the correction layer to be triggered only when the model lacks confidence or encounters new situations, thereby saving resources and optimizing response generation.

[0145] The first inference snapshot can be the complete trajectory vector of the current detection result generation process. It can be obtained by numerically encoding the intermediate states (such as word probability distribution and context embedding) output by the model inference layer. It is used to characterize the real-time inference features of the current task. For example, it can be used to characterize the analysis path vector of the log content by the model in the threat classification task.

[0146] Among them, the reasoning memory bank can be a pre-set persistent memory database (such as a long-term knowledge base), which can be constructed by storing the processing trajectory vectors of historical tasks after accurate processing by a large language model, and is used to provide a reference benchmark for similarity retrieval.

[0147] The second inference snapshot can be the historical record in the inference memory that is most similar to the first inference snapshot. It can be retrieved by calculating the cosine similarity between the first inference snapshot and all processing trajectory vectors in the inference memory. The second inference snapshot can be used to compare the consistency between the current response and past experience, such as vectors that highly match historical IP resolution records in log parsing tasks, to ensure that the model has sufficient experience to handle the current cybersecurity task.

[0148] The inference snapshot offset can be a quantified value of the difference between the first and second inference snapshots, which can be used to assess the novelty of the current response (a high offset indicates a deviation from historical experience).

[0149] In some implementations, a first inference snapshot can be calculated for each detection result. Specifically, the complete inference process of the current cybersecurity task can be encoded through the embedding layer of a neural network to obtain the first inference snapshot. Subsequently, a similarity search can be performed in the preset inference memory based on the first inference snapshot. During the search process, the similarity between the first inference snapshot and multiple historical task processing trajectory vectors stored in the inference memory is calculated. Cosine similarity between The historical task processing trajectory vector with the highest similarity to the first inference snapshot is determined as the second inference snapshot.

[0150] Furthermore, the difference between the first and second inference snapshots can be calculated using the following formula to obtain the inference snapshot offset corresponding to each detection result. :

[0151] ;

[0152] in, This represents the first inference snapshot. This represents the second inference snapshot.

[0153] In some implementations, in addition to using cosine similarity to calculate the similarity between the first inference snapshot and the second inference snapshot, Mahalanobis distance can be used instead of cosine similarity to better handle the complex relationships between high-dimensional features.

[0154] By using the above method, the thinking trajectory of the large language model for the current cybersecurity task can be characterized by obtaining the first inference snapshot. Then, by using the difference between the first and second inference snapshots, it can be determined whether the large language model adopts a new thinking trajectory (corresponding to a cybersecurity task with higher novelty). This makes it easier to decide whether to trigger iterative thinking in the future, realizing dynamic verification and adaptive optimization of detection results, and enhancing the credibility of the large language model's decision-making for unseen cybersecurity tasks.

[0155] Step 103: Obtain the confidence level of each detection result, and when the inference snapshot offset is greater than the first threshold or the confidence level is less than the second threshold, perform fact inference on each detection result through the verification layer to obtain the fact inference result.

[0156] In some implementations, to verify the reliability of detection results and correct anomalies, the dual indicators of confidence (reflecting the credibility of the model's own judgment) and bias (reflecting the consistency of historical inference) can be combined to verify the detection results. When the verification condition is triggered, the detection results are reconfirmed through the verification layer (such as rule-based logic verification or fact-based reasoning engine) to correct errors that the model may have caused by noisy input, overfitting, or adversarial examples, thereby improving the robustness and decision credibility of the system in complex scenarios. At the same time, it is ensured that the high-cost verification process is only initiated when necessary to avoid wasting resources.

[0157] The confidence level can be a measure of the model's certainty about the detection results. It can be calculated by taking the maximum value of the output probability distribution and is used to evaluate the reliability of the response. For example, the probability confidence value of the "malware" category in a threat classification task can be calculated as 0.92.

[0158] The first threshold can be a preset offset threshold, such as 0.7, which can be set through historical experimental data or by technical personnel, and is used to determine whether the large language model has encountered a new situation. The first threshold can be set according to the actual situation, and this application embodiment does not specifically limit it.

[0159] The second threshold can be a preset confidence threshold, such as 0.15, which can be set according to the requirements of the domain task to determine whether the model lacks confidence. The second threshold can be set according to the actual situation, and this application embodiment does not impose specific limitations on it.

[0160] Among them, the factual reasoning results can serve as a guarantee of the credibility of the output of the verification layer. They can be generated by performing consistency checks on the detection results through a knowledge graph, and are used to provide a basis for correction.

[0161] In some implementations, it can be done by Obtain the confidence level for each detection result:

[0162] in, The original predicted value output by the large language model is a vector. That is to The transformation yields a new probability distribution where all elements of the vector are in the interval (0,1) and the sum of all elements is 1. This allows each element's value to be interpreted as the probability that the model assigns to the corresponding class. That is, the function that takes the maximum value, which acts on The obtained probability distribution vector is used to identify and return its maximum value. This maximum value represents the model's confidence in its most likely prediction (i.e., the most probable category). A low value indicates that the large language model is uncertain and lacks confidence in the current detection result. Therefore, when the confidence falls below the second threshold, such as below 0.3, the iterative process of the large language model can be triggered to perform re-inference.

[0163] In some implementations, the uncertainty can be obtained by subtracting the confidence level from 1. :

[0164] ;

[0165] In this way, the confidence of a large language model can be converted into uncertainty. When the uncertainty of the large language model is higher than a threshold, such as higher than 0.7, the iterative process of the large language model can be triggered to perform re-inference.

[0166] In some implementations, when the inference snapshot offset is greater than a first threshold, such as greater than 0.5, it indicates that the large language model has encountered a new problem, which is why a first inference snapshot with a large offset from the closest second inference snapshot is generated. At this time, the iterative process of the large language model can be triggered to perform re-inference.

[0167] In some implementations, iterative inference is not required only if the inference snapshot offset is less than a first threshold and the confidence level is greater than a second threshold at the same time; otherwise, iterative inference is required if the inference snapshot offset is greater than the first threshold, or the confidence level is less than the second threshold, or if the inference snapshot offset is greater than the first threshold and the confidence level is less than the second threshold.

[0168] In some implementations, the verification layer can perform consistency checks on each detection result based on an external knowledge graph (such as the MITRE ATT&CK graph) and output factual inference results through rule matching algorithms (such as subgraph isomorphism). For example, the detection results output by the inference layer... It could be something like, "The attack source IP originated from region N, used spear-phishing emails, and the attack method is similar to that of the APT29 group." After querying threat intelligence, the verification layer can output the factual reasoning result as follows: : [(APT29, region, Eastern Europe)] / / The knowledge graph records that APT29 is mainly active in region E, rather than region N.

[0169] Furthermore, the result of factual reasoning is: It can also include corresponding factual reasoning levels, such as High, Medium, and Low, which serve as a bridge connecting fact verification and the final decision. For example, the system strategy might be: when When set to High, the factual reasoning result corresponding to the reasoning layer is directly output. It is marked as "verified by an authoritative knowledge base".

[0170] By combining inference snapshot offset with real-time confidence assessment, it is possible to accurately screen out new situations or problems encountered by large language models, or situations where they lack confidence in their own detection results, and trigger the verification and correction layers for further processing. In this way, it is possible to achieve dual optimization of the stability and credibility of large language model decision-making in complex cybersecurity scenarios, significantly reduce the false judgment rate and improve the domain compliance of the conclusions.

[0171] Step 104: Input each detection result and fact reasoning result into the correction layer to correct the difference in reasoning results and obtain correction instructions.

[0172] In some implementations, to achieve iterative optimization of cybersecurity multi-task response results and hallucination suppression, the detection results can be... and the result of factual reasoning Difference analysis is performed in the input correction layer to generate specific correction instructions. This guides the model to correct errors in the next round of inference, thereby building a self-reflective closed loop and significantly improving domain compliance, detection efficiency, and accuracy.

[0173] Among them, the correction instruction can be a language-based correction prompt output by the correction layer. It can be generated by the correction layer for each cybersecurity task by comparing the difference between the detection results and the factual reasoning results, and is used to optimize subsequent responses in a targeted manner, such as forcing the model to supplement protocol fields or adjusting threat classification conclusions.

[0174] In some implementations, each detection result can be... Its output comes from the detection results, such as threat classification labels, and factual inference results. It comes from the conclusions obtained by the verification layer through knowledge graph verification, such as ATT&CK tactical ID; and will and The input is sent to the correction layer, which analyzes the differences between the two and generates correction instructions. This allows for targeted correction of reasoning errors and improved accuracy of results.

[0175] For example, the detection results output by the inference layer It could be something like, "The attack source IP originated from region N, used spear-phishing emails, and the attack method is similar to that of the APT29 group." The verification layer, after querying the threat intelligence key, can output the factual reasoning result as follows: : [(APT29, region, Eastern Europe)] / / The knowledge graph records that APT29 is mainly active in region E, rather than region N.

[0176] So, the correction instructions output by the correction layer It can include problem identification and root cause analysis, and specific action instructions, for example, It can be:

[0177] "Your previous attribution analysis contained geographical inconsistencies. You indicated the attack originated from region N, but attributed it to an organization primarily active in region E (APT29), which is inconsistent. Please reanalyze:"

[0178] 1. Re-examine the source IP of the attack. Could it be a hijacked relay or a Virtual Private Network (VPN) being used?

[0179] 2. In addition to geographic information, please focus more on comparing attack methods. For example, query other active organizations related to 'spear phishing' in the knowledge graph and compare their malicious code signatures, C2 infrastructure patterns, etc.

[0180] 3. Consider the possibility of copycat crimes.

[0181] It should be noted that, It is a very specific and actionable correction instruction that will serve as an important input for the next round of inference.

[0182] By using the above methods, the accuracy of error response correction can be effectively improved, providing highly reliable input for subsequent collaborative reasoning and ensuring end-to-end logical consistency in multi-task decision-making.

[0183] Step 105: Input each detection result, each cybersecurity task, and correction instruction into the inference layer to obtain the target detection result corresponding to each cybersecurity task.

[0184] In some implementations, in order to achieve iterative optimization and ultimate reliability assurance of cybersecurity multi-task response, the historical response information and correction instructions generated by the detection results of each cybersecurity task in the previous round can be re-input into the inference layer. Combined with knowledge anchoring constraints (refer to the processing process of the attention mechanism above), secondary inference can be performed to generate high-confidence outputs that conform to domain knowledge, thereby significantly alleviating the illusion problem and improving the accuracy of decision-making.

[0185] The target detection result can be the final, accurate response after at least one iteration of reflection and correction, such as an optimized threat classification label.

[0186] In some implementations, the large language model can modify instructions based on the cybersecurity task and corresponding detection results for each cybersecurity task that requires re-iteration, and generate historical response information. , It can include the detection results generated by the previous round of the large language model. Structured intermediate results, multiple reasoning refinement steps, and query statements, or at least one of the above.

[0187] For example, a structured intermediate result can be a stage conclusion with clear semantic tags generated during the previous round of reasoning. For instance, when analyzing logs, it could be: "Round 1: I have extracted 10 abnormal login records from the raw logs."

[0188] For example, multiple reasoning improvement steps can be action plans or step lists formed by decomposing complex tasks, used to guide the model in focused iterations. For instance, in an emergency response task, it could be "Step 1: Confirm the existence of the vulnerability. Step 2: Assess the scope of the vulnerability's impact. Step 3: Develop mitigation measures." The next round could focus on improving these steps, or improving a specific step within them.

[0189] For example, a query statement can be machine-readable code, a command, or a database query statement generated to obtain external information or perform a specific operation. For instance, a query statement could be: "I wrote the following Splunk query statement to search for abnormal traffic: index=netflow...".

[0190] In some implementations, the cybersecurity task, the aforementioned historical response information, and the corresponding correction instructions can be output together to the next iteration to obtain the corresponding target detection results.

[0191] In some implementations, if the inference snapshot offset corresponding to the target detection result is greater than a first threshold, or the confidence level is less than a second threshold, the next round of looping is triggered. Each loop is as described above, that is, the factual inference result of the target detection result is output through the verification layer, the corresponding correction instruction is output through the correction layer, and then the historical response information corresponding to each detection result, each cybersecurity task, and the correction instruction are re-inputted into the inference layer to obtain the updated target detection result. The loop stops when the inference snapshot offset corresponding to the target detection result is less than the first threshold and the confidence level is greater than the second threshold, and the final target detection result is obtained.

[0192] This application embodiment acquires multiple cybersecurity tasks and inputs them into the inference layer of a large language model for parallel analysis, obtaining detection results for each cybersecurity task. The large language model includes an inference layer, a verification layer, and a correction layer. For each detection result, a first inference snapshot is read, and a similarity search is performed in a preset inference memory based on the first inference snapshot to obtain a second inference snapshot. Based on the difference between the first and second inference snapshots, the inference snapshot offset for each detection result is calculated. The confidence level of each detection result is obtained, and when the inference snapshot offset is greater than a first threshold or the confidence level is less than a second threshold, factual inference is performed on each detection result through the verification layer to obtain a factual inference result. Each detection result and the factual inference result are input into the correction layer for inference result difference correction to obtain a correction instruction. Each detection result, each cybersecurity task, and the correction instruction are input into the inference layer to obtain the target detection result corresponding to each cybersecurity task. Thus, through dynamic multi-level verification and iterative correction, error detection, correction, and prevention of error propagation can be achieved. Specifically, parallel processing, rather than processing multiple cybersecurity tasks in multiple models or batches, fully utilizes the contextual information between tasks, supporting multi-dimensional correlation analysis within the same inference process, significantly enhancing logical consistency, inference efficiency, and result accuracy. Simultaneously, relying on dual threshold judgments of inference snapshot offset and confidence level to trigger structured verification and correction processes effectively curbs cascading errors caused by initial misjudgments and significantly reduces the incidence of illusions by constraining the inference path. In summary, this application can significantly enhance the accuracy, reliability, and robustness of cybersecurity analysis results while improving multi-task processing efficiency. Therefore, this application can improve the accuracy of cybersecurity task processing results.

[0193] In some implementations, to achieve iterative optimization and reliability convergence of cybersecurity multi-task response, the next round of correction can be triggered when the inference snapshot offset corresponding to the detection result is greater than a first threshold or the confidence level is less than a second threshold. Intermediate results are dynamically updated until a target detection result that satisfies the condition of an inference snapshot offset less than the first threshold or a confidence level greater than the second threshold is output. This reduces the illusion rate to an acceptable range while ensuring efficiency, thereby improving the accuracy of cybersecurity task processing. For example, step 105 may include:

[0194] (105.a1) Input each detection result, each cybersecurity task, and correction instruction into the inference layer to obtain intermediate detection results;

[0195] (105.a2) Calculate the updated inference snapshot offset and update confidence based on the intermediate detection results, and when the updated inference snapshot offset is greater than the first threshold or the update confidence is less than the second threshold, determine the updated fact inference result corresponding to the intermediate detection results through the verification layer, and generate an update correction instruction based on the intermediate detection results and the updated fact inference result through the correction layer, and generate an updated detection result based on the intermediate detection results, each cybersecurity task and the update correction instruction through the inference layer;

[0196] (105.a3) Repeatedly execute the steps of calculating the updated inference snapshot offset and update confidence based on the intermediate detection results, and when the updated inference snapshot offset is greater than the first threshold or the update confidence is less than the second threshold, determine the update fact inference result corresponding to the updated detection result through the verification layer, generate an update correction instruction based on the updated detection result and the update fact inference result through the correction layer, and generate an updated detection result based on the updated detection result, each cybersecurity task and the update correction instruction through the inference layer, until the updated inference snapshot offset is less than the first threshold and the update confidence is less than the second threshold, and use the updated detection result as the target detection result for each cybersecurity task.

[0197] Intermediate detection results can be responses generated during the iteration process, such as threat classification labels after the first round of correction, which are used for subsequent verification and further correction.

[0198] The updated inference snapshot offset can be a recalculated inference snapshot offset based on intermediate detection results, used to determine whether further correction is needed.

[0199] Among them, the update confidence can be a deterministic measure of intermediate detection results, used to determine whether further correction is needed.

[0200] Among them, updating the fact reasoning result can be a new round of verification output of the verification layer on the intermediate detection result, which can be generated by performing consistency checks on the intermediate detection result through the knowledge graph.

[0201] Among them, the update correction instruction can be an optimization hint generated by the correction layer based on the difference between the intermediate detection results and the updated fact reasoning results, which is used to guide the next round of reasoning.

[0202] The updated detection result can be either the final converged response of the iteration or an intermediate transition result.

[0203] In some implementations, when the inference snapshot offset is greater than a first threshold or the confidence level is less than a second threshold, the historical response information corresponding to each detection result can be used. Each cybersecurity task and correction instructions The input is fed into the inference layer, where a large language model (such as a model based on the Transformer architecture) is used to generate intermediate detection results for the next round. The specific process is as follows:

[0204] ;

[0205] in, It can be a core function interface for calling the Large Language Model (LLM), which is integrated into the inference layer of the LLM and supports the dynamic combination of domain knowledge constraints (such as MITREATT&CK knowledge graphs) and attention mechanisms to improve the consistency of inference logic and the accuracy of results.

[0206] Afterwards, based on the intermediate test results The calculation of the updated inference snapshot offset and update confidence is the same as that described above. The specific process can be found in the above text and will not be repeated here.

[0207] Furthermore, when the offset of the updated inference snapshot is greater than the first threshold, or the update confidence is less than the second threshold, the updated fact inference result corresponding to the intermediate detection result can be determined through the verification layer. The specific process is as follows:

[0208] ;

[0209] in, It can be a verification function used to determine the updated fact inference result corresponding to the intermediate detection result.

[0210] The specific method for obtaining updated factual reasoning results is the same as the method for obtaining factual reasoning results described above. The specific process can be found in the above text and will not be repeated here.

[0211] Furthermore, an update correction instruction can be generated by the correction layer based on the intermediate detection results and the update fact reasoning results. The specific process is as follows:

[0212] ;

[0213] in, It can be a correction function used to generate update correction instructions based on intermediate detection results and update fact reasoning results.

[0214] The specific method for obtaining update and correction commands is the same as the method for obtaining correction commands described above. The specific process can be found in the above text and will not be repeated here.

[0215] Therefore, the inference layer can generate update detection results based on intermediate detection results, each cybersecurity task, and update correction instructions. The specific process is as follows:

[0216] ;

[0217] If the offset of the updated inference snapshot corresponding to the updated detection result is greater than the first threshold, or the update confidence is less than the second threshold, the subsequent loop continues to be triggered to continuously generate updated detection results until the offset of the updated inference snapshot is less than the first threshold and the update confidence is less than the second threshold. At this point, the loop can be stopped, and the updated detection result is used as the target detection result for each cybersecurity task.

[0218] By using the above methods, the detection results of cybersecurity multi-tasks can be dynamically iterated and optimized, thereby improving the accuracy and efficiency of inference, facilitating subsequent deployment in security incident response, and reducing false positive rates and response delays.

[0219] In some implementations, to output more accurate and interpretable target detection results for cybersecurity tasks, a large language model can be used to explicitly generate structured reasoning improvement steps based on the detection results and correction instructions. Multiple reasoning improvement steps, along with the original input, are then injected into the reasoning layer to guide the model through phased and traceable logical deduction. This addresses potential issues such as reasoning jumps, logical gaps, or insufficient execution of correction instructions when directly generating target detection results, thereby improving decision interpretability while reducing the illusion rate. For example, step 105 may further include:

[0220] (105.b1) Generate multiple reasoning improvement steps based on each detection result and correction instruction;

[0221] (105.b2) Input each detection result, each cybersecurity task, correction instructions and multiple inference improvement steps into the inference layer to obtain the target detection result.

[0222] In some implementations, multiple reasoning refinement steps can be action plans or step lists formed by decomposing complex tasks, used to guide the model in focused iterations. For example, in an emergency response task, it could be "Step 1: Confirm the existence of the vulnerability. Step 2: Assess the scope of the vulnerability's impact. Step 3: Develop mitigation measures." The next round can focus on refining the above multiple reasoning refinement steps sequentially, or refine one step and then refine the next step in the next round.

[0223] Furthermore, by inputting the cybersecurity tasks that need to be iterated, the corresponding correction instructions, the detection results, and multiple inference improvement steps into the inference layer, the target detection results can be obtained.

[0224] By employing the above methods, logical jumps and deviations in corrective instruction execution when directly generating results can be effectively eliminated, enabling the model to verify the reasoning logic stage by stage. On the other hand, traceable reasoning steps provide clear decision-making basis for the results, significantly reducing false alarm and false negative rates and enhancing the stability of the system in adversarial environments.

[0225] In some implementations, to achieve continuous accumulation of cybersecurity multi-task experience and optimization of inference efficiency, the complete inference trajectory corresponding to the final target detection result (i.e., the most accurate detection result for the current cybersecurity task) can be transformed into a target inference snapshot and stored in a preset inference memory to build a domain knowledge-enhanced long-term memory. This provides a similarity retrieval benchmark for subsequent tasks and accelerates the response to new problems. For example, after step 105, i.e., after "inputting each detection result, each cybersecurity task, and correction instructions into the inference layer to obtain the target detection result corresponding to each cybersecurity task," the following may also be included:

[0226] (A.1) Obtain multiple target inference snapshots corresponding to multiple target detection results;

[0227] (A.2) Store multiple target inference snapshots into the inference memory.

[0228] The target inference snapshot can be a complete trajectory vector generated based on the target detection results, with each cybersecurity task corresponding to one target detection result. For example, the target inference snapshot can be a vectorized representation of the inference path leading to the final conclusion when the cybersecurity task is port scanning detection.

[0229] The reasoning memory can be a pre-defined persistent memory database, that is, a structured experience base built by storing target reasoning snapshots of historical tasks (which are used as historical task processing trajectory vectors in the reasoning memory) to support similarity retrieval.

[0230] In some implementations, target inference snapshots can be categorized and stored in the inference memory according to their corresponding categories. For example, multiple target inference snapshots can correspond to threat classification, log parsing, vulnerability assessment, etc., and each target inference snapshot can be stored in the inference database according to the category to which its corresponding cybersecurity task belongs.

[0231] By using the above methods, the reasoning trajectory of high-confidence responses can be preserved as structured experience, which can help improve the detection efficiency, detection comprehensiveness and detection accuracy of novelty (snapshot offset) in the future.

[0232] Please see Figure 4 This application also provides a cybersecurity task processing device that can implement the above-described cybersecurity task processing method. The cybersecurity task processing device includes:

[0233] The acquisition module 41 is used to acquire multiple cybersecurity tasks and input the multiple cybersecurity tasks into the inference layer of the large language model for parallel analysis to obtain the detection results corresponding to each cybersecurity task. The large language model includes an inference layer, a verification layer and a correction layer.

[0234] The calculation module 42 is used to read the corresponding first inference snapshot for each detection result, perform similarity retrieval in the preset inference memory based on the first inference snapshot to obtain the corresponding second inference snapshot, and calculate the inference snapshot offset corresponding to each detection result based on the difference between the first inference snapshot and the second inference snapshot.

[0235] The inference module 43 is used to obtain the confidence level of each detection result, and when the inference snapshot offset is greater than the first threshold or the confidence level is less than the second threshold, it performs fact inference on each detection result through the verification layer to obtain the fact inference result;

[0236] The correction module 44 is used to input each detection result and fact reasoning result into the correction layer to correct the difference in reasoning results and obtain correction instructions;

[0237] Input module 45 is used to input each detection result, each cybersecurity task, and correction instruction into the inference layer to obtain the target detection result corresponding to each cybersecurity task.

[0238] The specific implementation of this cybersecurity task processing device is basically the same as the specific embodiment of the cybersecurity task processing method described above, and will not be repeated here. Subject to meeting the requirements of the embodiments of this application, the cybersecurity task processing device may also be equipped with other functional modules to implement the cybersecurity task processing method in the above embodiments.

[0239] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described cybersecurity task processing method. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0240] Please see Figure 5 , Figure 5 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0241] The processor 51 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0242] The memory 52 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 52 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 52 and is called and executed by the processor 51 to execute the network security task processing method of the embodiments of this application.

[0243] Input / output interface 53 is used to implement information input and output;

[0244] The communication interface 54 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0245] Bus 55 transmits information between various components of the device (e.g., processor 51, memory 52, input / output interface 53, and communication interface 54);

[0246] The processor 51, memory 52, input / output interface 53, and communication interface 54 are connected to each other within the device via bus 55.

[0247] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described cybersecurity task processing method.

[0248] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0249] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0250] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0251] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0252] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0253] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0254] It should be understood that in this application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0255] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0256] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0257] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0258] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0259] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A cyber security task processing method, characterized by, The method comprises: obtaining a plurality of network security tasks, and inputting the plurality of network security tasks into an inference layer of a large language model for parallel analysis to obtain a detection result corresponding to each network security task, wherein the large language model comprises an inference layer, a verification layer and a correction layer; reading a corresponding first inference snapshot for each detection result, performing similarity retrieval in a preset inference memory bank based on the first inference snapshot to obtain a corresponding second inference snapshot, and calculating an inference snapshot offset degree corresponding to each detection result based on the difference between the first inference snapshot and the second inference snapshot; obtaining a confidence degree of each detection result, and when the inference snapshot offset degree is greater than a first threshold or the confidence degree is less than a second threshold, performing fact inference on each detection result through the verification layer to obtain a fact inference result; inputting each detection result and the fact inference result into the correction layer for inference result difference correction to obtain a correction instruction; inputting each detection result, each network security task and the correction instruction into the inference layer to obtain an intermediate detection result; calculating an updated inference snapshot offset degree and an updated confidence degree according to the intermediate detection result, and when the updated inference snapshot offset degree is greater than the first threshold or the updated confidence degree is less than the second threshold, determining an updated fact inference result corresponding to the intermediate detection result through the verification layer, generating an updated correction instruction based on the intermediate detection result and the updated fact inference result through the correction layer, and generating an updated detection result based on the intermediate detection result, each network security task and the updated correction instruction through the inference layer; repeating the steps of calculating an updated inference snapshot offset degree and an updated confidence degree according to the intermediate detection result, and when the updated inference snapshot offset degree is greater than the first threshold or the updated confidence degree is less than the second threshold, determining an updated fact inference result corresponding to the updated detection result through the verification layer, generating an updated correction instruction based on the updated detection result and the updated fact inference result through the correction layer, and generating an updated detection result based on the updated detection result, each network security task and the updated correction instruction through the inference layer until the updated inference snapshot offset degree is less than the first threshold and the updated confidence degree is less than the second threshold, and taking the updated detection result as a target detection result of each network security task.

2. The cyber task processing method of claim 1, wherein, The step of inputting each detection result, each network security task and the correction instruction into the inference layer to obtain a target detection result corresponding to each network security task further comprises: generating a plurality of inference improvement steps according to the detection result and the correction instruction; inputting the detection result, the network security task, the correction instruction and the plurality of inference improvement steps into the inference layer to obtain a target detection result.

3. The cyber task processing method of claim 1, wherein, The step of inputting the plurality of network security tasks into the inference layer of the large language model for parallel analysis to obtain a detection result corresponding to each network security task comprises: The plurality of network security tasks are input into an inference layer of a large language model, and for each network security task, query information contained in the network security task is linearly transformed in parallel to obtain a corresponding query matrix; Contextual inference information corresponding to each network security task is obtained, and the contextual inference information is linearly transformed to obtain a key matrix; Target knowledge information is extracted from each network security task, and the target knowledge information is linearly transformed to obtain a value matrix; A preset knowledge database is obtained, and a search is performed in the knowledge database based on each network security task to obtain target knowledge base information; A corresponding knowledge mask matrix is generated based on the target knowledge base information; A position mask matrix set for each network security task is obtained, and attention calculation is performed on each network security task based on the query matrix, the key matrix, the value matrix, the knowledge mask matrix, and the position mask matrix to obtain a corresponding detection result.

4. The cyber task processing method of claim 3, wherein, The attention calculation based on the query matrix, the key matrix, the value matrix, the knowledge mask matrix, and the position mask matrix on each network security task to obtain a corresponding detection result includes: A first product is obtained based on the product of the query matrix and the transpose matrix of the key matrix; A key vector dimension corresponding to the key matrix is obtained, and a first ratio is obtained based on the ratio between the first product and the key vector dimension; The position mask matrix is shielded to obtain a shielding result, and an attention matrix is determined based on the sum of the shielding result and the knowledge mask matrix; The attention matrix is logarithmically processed to obtain a processing result, and a second product is obtained based on the product between the processing result and a preset knowledge weight coefficient; A knowledge-enhanced attention is obtained based on the sum of the first ratio and the second product; The value matrix is subjected to attention calculation based on the knowledge-enhanced attention to obtain a corresponding detection result.

5. The cyber task processing method of claim 1, wherein, The plurality of network security tasks are obtained, including: A plurality of initial network security tasks are obtained, and each initial network security task is matched with a preset task category to determine a corresponding target task template, wherein the plurality of initial network security tasks belong to different task categories; The plurality of initial network security tasks are respectively input into a plurality of corresponding target task templates to obtain a plurality of network security tasks.

6. The cyber task processing method of claim 1, wherein, After the each detection result, the each network security task, and the correction instruction are input into the inference layer to obtain a target detection result corresponding to each network security task, the method further includes: A plurality of target detection results correspond to a plurality of target inference snapshots; The plurality of target inference snapshots are stored in the inference memory bank.

7. A cyber mission processing apparatus, characterized by comprising: The device includes: An acquisition module is configured to obtain a plurality of network security tasks, and input the plurality of network security tasks into an inference layer of a large language model for parallel analysis to obtain a detection result corresponding to each network security task, wherein the large language model includes an inference layer, a verification layer, and a correction layer; The computing module is configured to read a corresponding first inference snapshot for each detection result, perform similarity retrieval in a preset inference memory library based on the first inference snapshot, obtain a corresponding second inference snapshot, and calculate an inference snapshot offset degree corresponding to the each detection result based on a difference between the first inference snapshot and the second inference snapshot. The inference module is configured to obtain a confidence degree of the each detection result, and perform fact inference on the each detection result through the verification layer to obtain a fact inference result when the inference snapshot offset degree is greater than a first threshold or the confidence degree is less than a second threshold. The correction module is configured to input the each detection result and the fact inference result into the correction layer to perform inference result difference correction and obtain a correction instruction. The input module is configured to input the each detection result, the each network security task, and the correction instruction into the inference layer to obtain an intermediate detection result, calculate an updated inference snapshot offset degree and an updated confidence degree based on the intermediate detection result, determine an updated fact inference result corresponding to the intermediate detection result through the verification layer when the updated inference snapshot offset degree is greater than the first threshold or the updated confidence degree is less than the second threshold, generate an updated correction instruction based on the intermediate detection result and the updated fact inference result through the correction layer, and generate an updated detection result based on the intermediate detection result, the each network security task, and the updated correction instruction through the inference layer. The steps of calculating an updated inference snapshot offset degree and an updated confidence degree based on the intermediate detection result, determining an updated fact inference result corresponding to the updated detection result through the verification layer when the updated inference snapshot offset degree is greater than the first threshold or the updated confidence degree is less than the second threshold, generating an updated correction instruction based on the updated detection result and the updated fact inference result through the correction layer, and generating an updated detection result based on the updated detection result, the each network security task, and the updated correction instruction through the inference layer are repeatedly performed until the updated inference snapshot offset degree is less than the first threshold and the updated confidence degree is less than the second threshold, and the updated detection result is taken as a target detection result of the each network security task.

8. A computer device, comprising: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the network security task processing method in any one of claims 1 to 6 when executing the computer program.

9. A computer readable storage medium, the storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the network security task processing method in any one of claims 1 to 6.

Images