Network abnormal behavior detection method and system based on multi-element prompt learning

Abstract

The invention relates to a network abnormal behavior detection method and system based on multi-element prompt learning. The process comprises the following steps: firstly, collecting data, and preprocessing, labeling, sorting and classifying the data to obtain a network abnormal behavior data set and a task category; designing and optimizing prompt information corresponding to each task category by utilizing a prompt engineering technology, and constructing a supervision fine tuning and evaluation data set; then, a low-rank adaptation technology is adopted, the large language model is finely adjusted based on the data set, and a network abnormal behavior analysis large model is obtained; and finally, inputting real-time network data, and outputting a detection result containing an exception type, a risk level and a disposal suggestion. Compared with the prior art, the method has the advantages of improving the learning efficiency and analysis precision of the model and the like.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network abnormal behavior detection method and system based on multi-element prompt learning. BACKGROUND

[0002] With the rapid development of information technology, network security problems have become a global focus. Existing network anomaly detection technologies include feature engineering, statistics, machine learning, etc. However, these methods have certain limitations and cannot meet the high precision and efficiency requirements of abnormal behavior detection in the current complex network environment.

[0003] Traditional rule-based methods mainly rely on manually defined rule sets for network traffic monitoring and abnormal behavior identification. However, the main drawback is that the rule set needs to be constantly updated and maintained, and it is difficult to adapt to new attack patterns and abnormal behaviors. Statistical-based methods establish a model of normal traffic by statistical analysis of network traffic data to identify abnormal behavior. However, they are easily affected by noise data when facing dynamic changes in network environment, resulting in high false positive and false negative rates. In recent years, machine learning technology has gradually become a research hotspot in network anomaly detection. By training with large-scale data, machine learning methods can adaptively learn the features in the data and improve the accuracy and efficiency of detection to some extent. However, existing machine learning methods rely on a large amount of labeled data for training and often fail to fully extract and integrate multiple information from network data, especially when facing complex attack patterns, there are still certain recognition blind spots.

[0004] In the invention patent with publication number CN118944942A, a zero-day attack detection method is disclosed, which constructs an unsupervised learning model for anomaly detection, optimizes the unsupervised learning model parameters using the peacock courtship algorithm, and improves the versatility and flexibility of the detection system. However, it still relies on a large amount of labeled data for training and fails to fully extract and integrate multiple information from network data. When facing complex attack patterns, there are still certain recognition blind spots, and the learning efficiency and analysis accuracy of the model still need to be further improved.

[0005] In summary, existing technologies still face many challenges in handling multi-source heterogeneous data, cross-domain data fusion, and high-dimensional information extraction. SUMMARY

[0006] The purpose of the present application is to overcome the shortcomings of the existing technology and provide a network abnormal behavior detection method and system based on multi-element prompt learning.

[0007] The purpose of the present application can be achieved through the following technical solutions:

[0008] According to one aspect of the present application, a network anomaly behavior detection method based on multi-element prompt learning is provided, and the method steps include:

[0009] S1, collecting data and performing preprocessing, labeling, organizing and classifying to obtain a network anomaly behavior dataset and task categories;

[0010] S2, using prompt engineering technology to design and optimize prompt information corresponding to each task category;

[0011] S3, based on the prompt information and the network anomaly behavior dataset, constructing a supervised fine-tuning dataset and an evaluation dataset;

[0012] S4, using low-rank adaptation technology, fine-tuning training a large language model based on the supervised fine-tuning dataset and the evaluation dataset to obtain a network anomaly behavior analysis large model;

[0013] S5, inputting real-time network data into the fine-tuned network anomaly behavior analysis large model to output network anomaly behavior detection results including abnormal type, risk level and disposal suggestions.

[0014] As a preferred technical solution, the preprocessing in S1 includes protocol compliance verification, traffic deduplication and noise filtering; the labeled objects include abnormal behavior types, trigger conditions and impact ranges in network data; the organization refers to the structural reorganization of the labeled data according to network protocol types and time sequences; the classification refers to dividing the data into task categories according to attack features of abnormal behaviors, and the task categories at least include network anomaly recognition, attack tracing, risk assessment and defense strategy generation.

[0015] As a preferred technical solution, in S2, the specific process of using prompt engineering technology to design and optimize prompt information corresponding to each task category includes:

[0016] S21, according to different task categories, performing text analysis on the network anomaly behavior dataset to extract task-related key information;

[0017] S22, for each specific task category, based on the key information extracted in S21, using multi-element prompt learning technology to design and optimize the corresponding prompt information;

[0018] For specific attack behavior recognition tasks, an attack feature anchor type prompt structure is constructed, which includes a typical network data feature template of this type of attack, a step-by-step mode description of attack implementation and background information of attack scene, guiding the model to focus on the exclusive recognition mode of attack behavior;

[0019] For the abnormal behavior tracing task, a correlation reasoning prompt structure is constructed, including a tracing target definition, multi-dimensional correlation clues, and reasoning logic guidance.

[0020] For the risk level evaluation task, a quantitative indicator prompt structure is constructed, which clearly defines the risk evaluation dimensions and the quantitative standards of each dimension, and guides the model to output quantitative evaluation results according to the preset rules.

[0021] As a preferred technical solution, the supervised fine-tuning dataset in S3 is constructed based on the data structure of subjective question answering based on Alpaca format; the evaluation dataset is constructed based on the data structure of objective multiple-choice questions based on Alpaca format.

[0022] As a preferred technical solution, the supervised fine-tuning dataset includes instruction (instruction) field, input (input) field and output (output) field, instruction field describes specific anomaly detection tasks; input field provides network packet fragments or traffic statistical features as input; output field contains expert annotated anomaly analysis report and disposal strategy.

[0023] As a preferred technical solution, the evaluation dataset includes instruction field, input field and output field, instruction field defines the requirements of the multiple-choice question task; input field provides network behavior summary and candidate options; output field contains option identifier and confidence score.

[0024] As a preferred technical solution, the evaluation dataset contains multiple tasks for network security abnormal behavior, including vulnerability analysis, attack defense, security standards and regulations, and network security knowledge.

[0025] As a preferred technical solution, the fine-tuning training in S3 includes a training phase and an evaluation phase; the training phase is to use LoRA (Low-Rank Adaptation) technology to perform low-rank adaptation training on the large language model. LoRA updates the weights of the pre-trained model locally and only adjusts the key low-rank part of the model. Through real-time monitoring of the loss function and precision index, the model is gradually converged after each training period and can effectively adapt to the needs of network security analysis tasks.

[0026] As a preferred technical solution, the evaluation phase compares the output of the model with the true results, measures the performance of the model on different tasks through standardized evaluation indicators, i.e. the evaluation accuracy on objective multiple-choice questions, and compares other base models; the trained model with accuracy greater than the preset accuracy value is output as a network anomaly behavior analysis large model.

[0027] According to another aspect of the present application, a network anomaly behavior detection system based on multi-element prompt learning is provided, which comprises a data collection and processing module, a prompt information generation module, a data set construction module, a model training module and an anomaly detection analysis module.

[0028] The data collection and processing module is used for collecting data and performing preprocessing, labeling, sorting and classification to obtain a network anomaly behavior data set and a task category.

[0029] The prompt information generation module designs and optimizes the prompt information corresponding to each task category by using prompt engineering technology.

[0030] The data set construction module constructs a supervised fine-tuning data set and an evaluation data set based on the prompt information and the network anomaly behavior data set.

[0031] The model training module fine-tunes and trains a large language model based on the supervised fine-tuning data set and the evaluation data set by using low-rank adaptation technology to obtain a network anomaly behavior analysis large model.

[0032] The anomaly detection analysis module receives current network data to be analyzed and inputs it into the fine-tuned network anomaly behavior analysis large model, so that the model analyzes and judges the network data according to the input data, combines the knowledge learned in the training process and the guidance of the multi-element prompt information, and outputs a clear network anomaly behavior detection result.

[0033] Compared with the prior art, the present application has the following beneficial effects:

[0034] 1. In the present application, through the systematic data processing and model training process, end-to-end detection of network anomaly behavior is realized, the completeness and automation degree of detection are improved, efficient detection results containing multi-dimensional information can be output, and the actual network security protection needs are met; in the process, the prompt information corresponding to each task category is designed and optimized by using prompt engineering technology to guide the pre-trained large language model, which can more accurately mine the key information in the network data. Compared with the traditional feature extraction method, this method can more comprehensively utilize the multi-dimensional information of network data, improve the learning efficiency and analysis accuracy of the model, and at the same time, the supervised fine-tuning data set and the evaluation data set are automatically constructed by the large model, which greatly reduces the labor cost.

[0035] 2. In the present application, the specific operations and task categories of each link such as preprocessing and labeling are clearly defined to ensure data quality and task specificity, provide high-quality input for subsequent model training, and improve the accuracy and professionalism of anomaly detection.

[0036] 3、The present application, using the prompt engineering technology is designed and optimized to obtain the prompt information corresponding to each task category, and the specific prompt structure is designed for different tasks, so as to guide the model to focus on key information and identification mode, enhance the adaptability of the model to specific tasks, and improve the accuracy of abnormal identification, tracing and risk assessment.

[0037] 4、The present application, using the specific format to construct the supervised fine-tuning dataset and the evaluation dataset, makes the supervised fine-tuning and evaluation more targeted and effective, and helps to improve the objectivity of model training effect and performance evaluation. The field design of the supervised fine-tuning dataset comprehensively covers task description, input data and expert output, providing rich learning basis for the model and helping the model to master abnormal analysis and disposal ability. The multiple-choice structure and field setting of the evaluation dataset facilitate the quantitative evaluation of model performance, provide clear direction for model optimization, and ensure the reliability of the model in actual application. The evaluation dataset covers various network security tasks, comprehensively tests the comprehensive ability of the model, and ensures that the model can effectively play a role in various network security scenarios.

[0038] 5、The present application, using LoRA technology for fine-tuning, realizes efficient adaptation and updating of the model, reduces the training cost while ensuring the performance of the model, so that the model can quickly adapt to network security analysis tasks. Through standardized index evaluation and model comparison, the high performance and reliability of the output model are ensured, and high-quality model support is provided for actual network anomaly detection. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 The network anomaly behavior detection method in the present application is shown in the figure;

[0040] Figure 2 The network anomaly behavior detection system workflow in the embodiment is shown in the figure. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0042] With the rapid development of large-scale models and pre-training techniques, multi-factor cue learning, especially its close connection to prompt engineering in large-scale models, has gradually become an emerging research direction. Multi-factor cue learning can guide large models to focus on important features and key information by constructing effective cue information, thereby improving the model's accuracy and robustness in handling complex tasks. Unlike traditional machine learning methods, multi-factor cue learning can more flexibly combine multi-dimensional data sources and heterogeneous information, thus improving the model's comprehensive recognition ability and generalization performance. However, existing network anomaly detection techniques have not yet fully utilized this emerging technology in practical applications, especially exhibiting significant shortcomings in large-scale, multi-dimensional information fusion.

[0043] Existing technologies still face numerous challenges in handling multi-source heterogeneous data, fusing cross-domain data, and extracting high-dimensional information. Therefore, this solution combines the advantages of multi-factor cue learning to improve the overall performance of existing detection methods.

[0044] Example 1

[0045] In this embodiment, a network abnormal behavior detection method based on multi-factor cue learning is adopted, and the method steps are as follows: Figure 1 As shown, it specifically includes:

[0046] S1. Collect data and perform preprocessing, labeling, organization, and classification to obtain a dataset of network abnormal behavior and task categories;

[0047] S2. Use prompting engineering techniques to design and optimize the prompting information corresponding to each task category;

[0048] S3. Based on the prompt information and network abnormal behavior dataset, construct a supervised fine-tuning dataset and an evaluation dataset;

[0049] S4. Using low-rank adaptation technique, the large language model is fine-tuned and trained based on supervised fine-tuning dataset and evaluation dataset to obtain a large model for network abnormal behavior analysis.

[0050] S5. Input real-time network data into the fine-tuned network anomaly behavior analysis model, and output network anomaly behavior detection results including anomaly type, risk level, and handling suggestions.

[0051] Preprocessing in S1 includes protocol compliance verification, traffic deduplication, and noise filtering; the labeled objects include the types of abnormal behaviors, triggering conditions, and impact ranges in the network data; sorting refers to the structured reorganization of the labeled data according to network protocol type and time series; classification refers to dividing the data into task categories based on the attack characteristics of abnormal behaviors, and the task categories include at least network anomaly identification, attack tracing, risk assessment, and defense strategy generation.

[0052] In S2, the specific process of designing and optimizing the prompt information corresponding to each task category includes:

[0053] S21, according to different task categories, text analysis is performed on the network abnormal behavior data set to extract task-related key information;

[0054] S22, for each specific task category, based on the key information extracted in S21, the corresponding prompt information is designed and optimized using multi-element prompt learning technology;

[0055] For specific attack behavior recognition tasks, an attack feature anchor type prompt structure is constructed, which includes a typical network data feature template of the attack, a step-by-step mode description of the attack implementation, and background information of the attack scene, guiding the model to focus on the exclusive recognition mode of the attack behavior;

[0056] For abnormal behavior tracing tasks, a correlation reasoning type prompt structure is constructed, which includes a trace target definition, multi-dimensional correlation clues, and reasoning logic guidance;

[0057] For risk level assessment tasks, a quantitative indicator type prompt structure is constructed, which clearly defines the risk assessment dimensions and the quantitative standards of each dimension, guiding the model to output quantitative assessment results according to the preset rules.

[0058] The supervised fine-tuning data set in S3 is constructed based on the data structure of subjective question and answer based on Alpaca format; the evaluation data set is constructed based on the data structure of objective selection question based on Alpaca format.

[0059] The supervised fine-tuning data set includes instruction field, input field and output field, the instruction field describes the specific anomaly detection task; the input field provides network packet fragments or traffic statistical features as input; the output field contains expert annotated anomaly analysis report and disposal strategy.

[0060] The evaluation data set includes instruction field, input field and output field, the instruction field defines the selection question task requirement; the input field provides network behavior summary and candidate options; the output field contains option identifier and confidence score.

[0061] The evaluation data set contains multiple tasks for network security abnormal behavior, including vulnerability analysis, attack defense, security standards and regulations, and network security knowledge.

[0062] The fine-tuning training in S3 includes a training phase and an evaluation phase; the training phase is low-rank adaptation training of the Qwen2.5-7B-Instruct model using the LoRA technology, LoRA updates the weights of the pre-trained model locally, and only adjusts the key low-rank part in the model; by monitoring the loss function and precision index in real time, it is ensured that the model gradually converges after each training period and can effectively adapt to the needs of network security analysis tasks.

[0063] The evaluation phase is to compare the output of the model with the true results, measure the performance of the model on different tasks through standardized evaluation indicators, i.e., the evaluation accuracy on objective questions, and evaluate and compare other base models; output the trained model with accuracy greater than the preset accuracy value as the network anomaly behavior analysis large model.

[0064] 1) Collection and preprocessing of network anomaly behavior data: by collecting a variety of data sources related to network anomaly behavior, including vulnerability data, attack records, network security specifications and network security knowledge, and preprocessing and screening these data, a high-quality original data set is constructed.

[0065] 2) Multi-element prompt learning data mining: using multi-element prompt learning technology, combined with pre-trained large language models or other deep learning models, effectively guide the model to focus on key features in network anomaly behavior through prompt engineering. Through carefully designed prompt information, multiple factors of network data are included in the model's learning process.

[0066] 3) Construction of supervised fine-tuning data set and evaluation benchmark: by designing efficient prompts, this scheme takes multi-dimensional information of network anomaly behavior as input prompts to accurately guide the pre-trained large model to construct a supervised fine-tuning data set for specific tasks; at the same time, design the corresponding prompt information to construct the evaluation data set, so as to comprehensively evaluate and verify the performance of the model.

[0067] 4) Training and evaluation: based on the supervised fine-tuning data set, the base model is trained and fine-tuned for network anomaly behavior analysis, and the performance of the fine-tuned model is comprehensively evaluated through a series of evaluation data and standard evaluation indicators to ensure that its analysis and detection capability in the field of network anomaly behavior is improved.

[0068] (2) Details of each part

[0069] Step 1) In the process of building a network anomaly behavior detection system, data collection is a crucial foundation. To ensure that the model can accurately identify abnormal behavior in a diverse network environment, this solution first collects a variety of data sources related to network anomaly behavior to provide rich materials for model training. The collected data usually contains a large amount of noise and redundant information, so data preprocessing is the key to building a high-quality data set. The preprocessing process first denoises and cleans the data, removes irrelevant information, format errors, or duplicate data, and ensures that each piece of information in the data set is valid. Then, the collected data is labeled, sorted, and classified to facilitate further processing.

[0070] Step 2) After obtaining the preprocessed original data with uniform format, this solution uses prompt engineering to guide the model to effectively focus on the key features of network anomaly behavior. Specifically, first, according to different task categories, the collected network data is analyzed to extract key information related to the task. These information may include attack types, attack methods, defense behaviors, vulnerability detection, etc. After careful screening, they become the core input for model learning.

[0071] Then, for each specific task category, the corresponding prompt information is designed and optimized. For example, for the task of identifying a specific attack behavior, a prompt containing relevant network data features, attack patterns, and background information is designed to guide the model to focus on the relevant patterns of this attack behavior. For other types of anomaly behavior detection tasks, different prompt structures are used to ensure that the model can flexibly cope with various anomaly behavior detection requirements in a multi-task environment.

[0072] Step 3) In this solution, the core step of building a supervised fine-tuning data set and evaluation benchmark is to design efficient prompt information to accurately guide the multi-dimensional information of network anomaly behavior into the pre-trained large language model, thereby constructing a training data set suitable for specific tasks. To achieve this goal, this solution uses two data structures based on Alpaca format, subjective question and answer and objective multiple-choice questions, to ensure that the model can efficiently learn and evaluate its performance.

[0073] The supervised fine-tuning dataset is constructed in the form of subjective question answering, containing guiding prompt information based on network security expert knowledge. Each sample includes an "instruction" field describing the task background and goal that the model should have, and an "input" field providing specific problem or task input. Through such design, the model can generate targeted output such as vulnerability analysis and solutions according to the problem in the learning process. In order to ensure the evaluation effect of the model in different network anomaly behavior scenarios, the objective multiple-choice question is designed as the evaluation dataset. These evaluation data are also presented in the standardized Alpaca format, which contains an "instruction" field to describe the task requirements, and an "input" field for the specific multiple-choice question content. The task of the model is to directly output the correct option letter according to the question.

[0074] Step 4) In this scheme, the low-rank adaptation technology (Low-Rank Adaptation) is used to fine-tune the open-source large language model Qwen2.5-7B-Instruct based on the LLaMAFactory framework. The network anomaly behavior data is injected into the large model using the supervised fine-tuning dataset constructed in step 3), so that it can more accurately handle the tasks of network security field anomaly behavior and vulnerability analysis. During the training process, the loss function and precision index are monitored in real time to ensure that the model gradually converges after each training period and can effectively adapt to the needs of network security analysis tasks.

[0075] After fine-tuning, the model is comprehensively evaluated using the designed evaluation dataset. The evaluation dataset contains various tasks for network security anomaly behavior, including vulnerability analysis, attack defense, security standards and regulations, and network security knowledge, ensuring the comprehensiveness and diversity of the evaluation. During the evaluation process, the output of the model is compared with the true results, and the evaluation accuracy on objective multiple-choice questions is used as the standardized evaluation index to measure the performance of the model in different tasks. At the same time, other base models are evaluated and compared.

[0076] In summary, through the systematic data processing and model training process, this application realizes the end-to-end detection of network anomaly behavior, improves the completeness and automation of detection, and can efficiently output detection results containing multi-dimensional information to meet the actual network security protection needs. During the process, the prompt engineering technology is used to design and optimize the prompt information corresponding to each task category to guide the pre-trained large language model to more accurately extract key information from network data. This method can more comprehensively utilize the multi-dimensional information of network data compared to traditional feature extraction methods, improving the learning efficiency and analysis accuracy of the model. At the same time, the automatic construction of supervised fine-tuning dataset and evaluation dataset by large model greatly reduces the labor cost.

[0077] Embodiment 2

[0078] In this embodiment, a network anomaly behavior detection system based on multi-element prompt learning is adopted, which includes a data acquisition and preprocessing module, a task classification and prompt information management module, a data set construction module, a model training module and an anomaly detection analysis module.

[0079] The data acquisition and preprocessing module is used for a variety of data sources related to network anomaly behavior, and the collected data is preprocessed to obtain a network anomaly behavior data set.

[0080] The task classification and prompt information management module classifies the detection process into multiple task categories based on the network anomaly behavior data set, and for each task category, the corresponding prompt information is designed and optimized.

[0081] The data set construction module constructs a supervised fine-tuning data set and an evaluation data set based on the optimized prompt information.

[0082] The model training module uses low-rank adaptation technology to fine-tune the large language model based on the supervised fine-tuning data set and the evaluation data set, and obtains a network anomaly behavior analysis large model.

[0083] The anomaly detection analysis module receives the current network data to be analyzed and inputs it into the trained network anomaly behavior analysis large model, so that the model analyzes and judges the network data according to the input data, combines the knowledge learned in the training process and the guidance of multi-element prompt information, and outputs clear network anomaly behavior detection results.

[0084] As shown in Figure 2 , a network anomaly behavior detection system based on multi-element prompt learning specific implementation includes the following steps:

[0085] Step 1: First, high-quality cybersecurity data is collected from networks and documents. These data sources include vulnerability data, historical attack records, cybersecurity specifications, and cybersecurity knowledge. Vulnerability data comes from various vulnerability databases such as CVE and NVD, containing detailed information about various vulnerabilities, such as vulnerability type, description, attack vector, and impact, which helps reveal potential security threats. Attack records mainly come from intrusion detection systems (IDS), firewall logs, and other security device historical logs, recording various attack behaviors in the network, such as attack source, attack method, timestamp, etc. Network security specifications provide standardized regulations for data, helping to determine whether behavior conforms to normal network security standards. Network security knowledge comes from the research results of field experts, which can provide in-depth understanding for the model, especially when facing unknown attack patterns to provide important clues. After data collection and preprocessing, about 20w original data is obtained and stored in json files in a unified text format.

[0086] Step 2: Text analysis is performed on the collected network data to extract key information related to the task. This solution uses the powerful context understanding and generation capabilities of the DeepSeek-V3 model to construct prompts to generate question and answer pairs. The prompt needs to include the design and requirements for different tasks. This solution calls the API for efficient batch processing of the original data. For supervised fine-tuning data sets, appropriate text data needs to be selected to generate subjective question and answer pairs. For evaluation data, text-based multiple-choice questions need to be generated based on high-quality data to facilitate evaluation and statistics of accuracy. In this solution, the prompt design for some tasks is as follows:

[0087] Task category: vulnerability analysis, task description: analyze and review potential vulnerabilities in applications or systems, identify and understand the nature of vulnerabilities and potential impact.

[0088] The prompt designed at this time is:

[0089] You are a cybersecurity expert, please generate a question and answer pair related to vulnerability analysis based on the provided text, which can be about vulnerability explanation, vulnerability description, detection methods, defense strategies, etc.

[0090] Requirements:

[0091] 1. The generated question must be derived from the text, and the answer must be derivable from the text. Both the question and the answer must be in Chinese.

[0092] 2. Return an object containing a question and an answer using the following JSON format:

[0093]

[0094] Example:

[0095]

[0096] Task category: Attack Analysis, Task description: In the face of unknown attacks, analyze the characteristics, patterns and possible sources of attacks to better understand and respond to threats.

[0097] Prompt design at this time:

[0098] You are a network security expert, please generate a question and answer pair about attack defense according to the provided text, which can be about attack explanation, attack method, defense method, etc.

[0099] Requirements:

[0100] 1. The generated question must be derived from the text, and the answer must be derived from the text. Both the question and the answer must be in Chinese.

[0101] 2. Return an object containing a question and an answer in the following JSON format:

[0102]

[0103] Example:

[0104]

[0105]

[0106] Task category: Security standards and regulations, Task description: Understand and accurately apply network security-related laws, standards and compliance requirements to enhance their ability to identify and handle compliance issues in actual network security analysis.

[0107] Prompt design at this time:

[0108] You are a network security expert, please generate a question and answer pair about network security standards and regulations according to the provided text, if the text contains the name of the regulation, you need to mention it in the question.

[0109] Requirements:

[0110] 1. The generated question must be derived from the text, and the answer must be derived from the text. Both the question and the answer must be in Chinese.

[0111] 2. Return an object containing a question and an answer in the following JSON format:

[0112]

[0113] Example:

[0114]

[0115] The task category is cybersecurity knowledge, and the task description is: explaining cybersecurity concepts, providing best practice recommendations, and analyzing the latest threat trends;

[0116] The Prompt is designed as follows:

[0117] You are a cybersecurity expert. Please generate a question-and-answer pair about cybersecurity knowledge based on the provided text. This can be about command explanations, concept explanations, etc.

[0118] Require:

[0119] 1. The generated questions must be derived from the text, and the answers must also be derivable from the text. Both questions and answers must be in Chinese.

[0120] 2. Return an object containing the question and answer using the following JSON format:

[0121]

[0122] Example:

[0123]

[0124] The task category is assessment task, and the task description is: multiple choice questions;

[0125] The Prompt is designed as follows:

[0126] You are a cybersecurity expert. Please generate two different cybersecurity multiple-choice questions based on the provided text, which can be about different aspects related to the task.

[0127] Require:

[0128] 1. The generated questions must be derived from the text, and the answers must be derivable from the text.

[0129] 2. Each question must contain four options, marked with A / B / C / D.

[0130] 3. There can only be one correct answer.

[0131] 4. Return an array containing two questions using the following JSON format:

[0132]

[0133]

[0134] Step 3, After further processing of the generated question and answer pairs, different system prompts (instructions) are designed according to each task category, and a supervised fine-tuning dataset and benchmark are constructed in Alpaca format (i.e., prompt-question-answer format). To improve the quality and effectiveness of the dataset, the number and quality of each type of question and answer are strictly controlled to ensure balanced and comprehensive question and answer pairs for each category. At the same time, a certain proportion of question and answer pairs are randomly selected for manual inspection and adjustment to ensure that the generated dataset is free of noise and errors. The constructed supervised fine-tuning data and benchmark are stored in a json file in the following format:

[0135]

[0136] The instruction for each task category is designed as follows:

[0137] When the task category is vulnerability analysis, the instruction is designed as: "You are a network security expert specializing in analyzing and explaining various network security vulnerabilities. Your task is to help users understand the principles of vulnerabilities, attack methods, and how to prevent these vulnerabilities."

[0138] When the task category is attack judgment: The instruction is designed as: "You are a network security expert specializing in analyzing and responding to various network attack techniques. Your task is to help users understand the principles of attacks, attack methods, and how to prevent these attacks."

[0139] When the task category is security standards and regulations, the instruction is designed as: "You are a network security expert specializing in various security standards and regulations. Your task is to help users answer questions about network security compliance, legal requirements, and security standards."

[0140] When the task category is network security knowledge, the instruction is designed as: "You are a network security expert specializing in analyzing and explaining various network security knowledge. Your task is to help users answer questions about network security."

[0141] When the task category is benchmark (benchmark), the instruction is designed as: "You are a rigorous examination system that must strictly follow the specified format to output answers. Answer the following multiple-choice questions, with only one correct answer. Please directly answer the correct option letter (A-D), without giving the option content, and without other text, symbols, or explanations."

[0142] Step 4, the Qwen2.5-7B-Instruct model is trained by using the LoRA technology for low-rank adaptation. LoRA is a fine-tuning method based on low-rank matrix decomposition, which updates the weights of the pre-trained model locally, and only adjusts the key low-rank part of the model.

[0143] After LoRA fine-tuning, the model is comprehensively evaluated on the benchmark designed in this scheme, covering four important areas: "vulnerability analysis", "attack defense", "security standards and regulations", and "network security knowledge". The results are shown in Table 3. The evaluation results show that the fine-tuned model based on the Qwen2.5-7B-Instruct model has significantly improved accuracy on various tasks. Specifically, in the "vulnerability analysis" task, the fine-tuned model improved by 12.70% compared to the original model, reaching an accuracy of 70.42%; in the "attack defense" task, the improvement was 4.03%, with an accuracy of 88.65%; in the "security standards and regulations" task, the improvement was 2.89%, with an accuracy of 91.03%; in the "network security knowledge" task, the improvement was 0.52%, with an accuracy of 92.26%.

[0144] As shown in Table 1, compared with other comparative models (such as chatglm3-6b, baichuan2-7b, internLM-7b, etc.), the fine-tuned Qwen2.5-7B-Instruct model has shown significant advantages, demonstrating excellent knowledge understanding and reasoning ability.

[0145] Table 1 Evaluation results of various models

[0146]

[0147]

[0148] In summary, the modules of the system have clear division of labor and work together to realize the full-process automation from data processing to anomaly detection, improving the efficiency and convenience of network anomaly behavior detection, and enhancing the real-time and effectiveness of network security protection.

[0149] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any skilled person in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network abnormal behavior detection method based on multi-element prompt learning, characterized in that, The method steps comprise: S1, collecting data and performing preprocessing, labeling, organizing and classifying to obtain network abnormal behavior data set and task categories; S2, using prompt engineering technology to design and optimize the prompt information corresponding to each task category; S3, based on the prompt information and the network abnormal behavior data set, constructing a supervised fine-tuning data set and an evaluation data set; S4, using low-rank adaptation technology, based on the supervised fine-tuning data set and the evaluation data set, fine-tuning training of the large language model to obtain a network abnormal behavior analysis large model; S5, inputting real-time network data into the fine-tuned network abnormal behavior analysis large model, and outputting network abnormal behavior detection results containing abnormal type, risk level and disposal suggestion. 2.The network abnormal behavior detection method based on multi-element prompt learning according to claim 1, wherein, The preprocessing in S1 includes protocol compliance verification, traffic deduplication and noise filtering; the labeled objects include abnormal behavior types, trigger conditions and impact ranges in network data; the organization refers to the structural reorganization of the labeled data according to network protocol types and time sequences; the classification refers to dividing the data into task categories according to attack features of abnormal behaviors, and the task categories at least include network anomaly recognition, attack tracing, risk assessment and defense strategy generation. 3.The network anomaly behavior detection method based on multi-element prompt learning according to claim 1, wherein, In S2, the specific process of using prompt engineering technology to design and optimize the prompt information corresponding to each task category comprises: S21, according to different task categories, performing text analysis on the network abnormal behavior data set to extract task-related key information; S22, for each specific task category, based on the key information extracted in S21, using multi-element prompt learning technology to design and optimize the corresponding prompt information; For specific attack behavior recognition tasks, an attack feature anchor type prompt structure is constructed, which contains typical network data feature templates of this type of attack, step-by-step mode description of attack implementation and background information of attack scene, guiding the model to focus on the exclusive recognition mode of attack behavior; For abnormal behavior tracing tasks, a correlation reasoning type prompt structure is constructed, which contains the definition of tracing target, multi-dimensional correlation clues and reasoning logic guidance; For risk level assessment tasks, a quantitative index type prompt structure is constructed, which clearly defines the risk assessment dimensions and the quantitative standards of each dimension, guiding the model to output quantitative assessment results according to the preset rules. 4.The network anomaly behavior detection method based on multi-element prompt learning according to claim 1, wherein, The supervised fine-tuning data set in S3 is constructed using the data structure of subjective question and answer based on Alpaca format; the evaluation data set is constructed using the data structure of objective selection question based on Alpaca format.

5. The method of claim 4, wherein the method comprises: The supervised fine-tuning data set includes instruction field, input field and output field, the instruction field describes specific abnormal detection tasks; the input field provides network packet fragments or traffic statistical features as input; the output field contains expert-labeled abnormal analysis reports and disposal strategies.

6. The method of claim 4, wherein the method comprises: The evaluation dataset includes an instruction field, an input field and an output field, the instruction field defines the requirements of the multiple-choice question task, the input field provides a network behavior summary and candidate options, and the output field includes an option identifier and a confidence score.

7. The network anomaly behavior detection method based on multi-element prompt learning according to claim 1, characterized in that, The evaluation dataset includes a plurality of tasks for network security abnormal behaviors, including vulnerability analysis, attack defense, security standards and regulations, and network security knowledge. 8.The network anomaly behavior detection method based on multi-element prompt learning according to claim 1, wherein, The fine-tuning training in the S3 includes a training phase and an evaluation phase; the training phase is low-rank adaptation training of the large language model using the LoRA technology, LoRA updates the weights of the pre-trained model locally, and only adjusts the key low-rank part of the model; by monitoring the loss function and precision index in real time, the model is gradually converged after each training period, and can effectively adapt to the needs of network security analysis tasks. 9.The network abnormal behavior detection method based on multi-element prompt learning according to claim 1, wherein, The evaluation phase is to compare the output of the model with the true result, measure the performance of the model on different tasks through standardized evaluation indicators, i.e., the evaluation accuracy on objective multiple-choice questions, and compare other base models; the trained model with an accuracy greater than a preset accuracy value is output as a network abnormal behavior analysis large model. 10.A network abnormal behavior detection system based on multi-element prompt learning, characterized in that, The system applies a network abnormal behavior detection method based on multi-element prompt learning as claimed in any one of claims 1-9, and the system includes a data acquisition and processing module, a prompt information generation module, a dataset construction module, a model training module and an abnormal detection analysis module; The data acquisition and processing module is used to collect data and perform preprocessing, annotation, organization and classification to obtain a network abnormal behavior dataset and task categories; The prompt information generation module designs and optimizes the prompt information corresponding to each task category using prompt engineering technology; The dataset construction module constructs a supervised fine-tuning dataset and an evaluation dataset based on the prompt information and the network abnormal behavior dataset; The model training module fine-tunes the large language model based on the supervised fine-tuning dataset and the evaluation dataset using low-rank adaptation technology to obtain a network abnormal behavior analysis large model; The abnormal detection analysis module receives the current network data to be analyzed and inputs it into the fine-tuned network abnormal behavior analysis large model, so that the model analyzes and judges the network data according to the input data, combines the knowledge learned in the training process and the guidance of the multi-element prompt information, and outputs clear network abnormal behavior detection results.

Images