Generation method of model training set and related equipment

Abstract

The embodiment of the invention discloses a model training set generation method and related equipment, and is used for the technical field of data processing. In the embodiment of the invention, a corresponding threat data template is generated based on original network threat data; generalizing variables in the threat data template to generate first network threat data; confusing the first network threat data to obtain confused second network threat data; performing data assembly on the second network threat data and the normal network data to obtain model training data; therefore, the obtained model training data has diversity, and a continuously evolved network attack mode can be comprehensively reflected.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and related equipment for generating a model training set. Background Technology

[0002] In existing cyberattacks (web attacks), attackers often target web application services by sending cyber threat data, which can be used to tamper with data, obtain sensitive information, and perform unauthorized operations. This cyber threat data can directly affect the security and data integrity of the target system. It can be code used to execute malicious operations or specific data used to exploit system vulnerabilities.

[0003] Existing methods often use large language models to identify cyber threat data and determine the existence of cyberattacks. To enable these models to identify cyber threat data, they need to be trained using a training set corresponding to the cyber threat data. Traditionally, the generation of training data relies primarily on cybersecurity personnel manually collecting and labeling cyber threat data from the internet.

[0004] However, due to the limitations of cybersecurity personnel's knowledge, the data collection tends to focus on network threat data corresponding to known network attack methods. Furthermore, the network threat data collected from the internet is usually relatively common, resulting in a lack of diversity in the generated model training data, making it difficult to fully reflect the constantly evolving network attack methods. Summary of the Invention

[0005] This application provides a method and related equipment for generating a model training set, which can make the obtained model training data diverse and can comprehensively reflect the constantly evolving network attack methods.

[0006] This application provides a method for generating a model training set, including:

[0007] Generate corresponding threat data templates based on raw network threat data;

[0008] The variables in the threat data template are generalized to generate the first network threat data;

[0009] The first network threat data is obfuscated to obtain obfuscated second network threat data;

[0010] The second network threat data and normal network data are assembled to obtain model training data.

[0011] Furthermore, the generation of the corresponding threat data template based on the original network threat data includes:

[0012] Among the original network threat data, target original network threat data with the same threat type and threat purpose are identified;

[0013] Extract common features from the target's original network threat data to generate a threat data template corresponding to the target's original network threat data.

[0014] Furthermore, the generalization process of the variables in the threat data template to generate first network threat data includes:

[0015] Determine the value range of the variables in the threat data template;

[0016] Randomly select variable values ​​from the range and fill them into the threat data template to generate the first network threat data.

[0017] Furthermore, determining the value range of the variables in the threat data template includes:

[0018] When the variable in the threat data template is a system command, the value range of the variable is the preset system command list;

[0019] When the variable in the threat data template is a string, the value range of the variable is a preset string dictionary;

[0020] When the variables in the threat data template are parameters, the range of values ​​for the variables is determined based on the threat type and threat purpose of the threat data template.

[0021] Furthermore, the obfuscation of the first network threat data to obtain obfuscated second network threat data includes:

[0022] The first network threat data is obfuscated using any one or more of the following obfuscation methods: encoding obfuscation, string obfuscation, and syntax obfuscation, to obtain obfuscated network threat data.

[0023] Test the validity of obfuscated network threat data and identify valid secondary network threat data within the obfuscated network threat data.

[0024] Furthermore, after obfuscating the first network threat data to obtain obfuscated second network threat data, the method further includes:

[0025] After assigning corresponding threat tag information to the second network threat data, it is stored in the database;

[0026] The step of assembling the second network threat data and normal network data to obtain model training data includes:

[0027] Receive a query request for target network threat data, and retrieve the target network threat data from the database based on the threat feature information of the target network threat data and the threat tag information of the second network threat data in the query request;

[0028] Determine the target threat data template corresponding to the target network threat data;

[0029] The target network threat data and the normal network data are filled into the target threat data template to obtain the model training data.

[0030] Furthermore, after assembling the second network threat data and normal network data to obtain model training data, the method further includes:

[0031] Obtain a threat identification model that has been pre-trained based on normal network data and network threat data;

[0032] Based on the threat identification model, the training data of the model is labeled with corresponding threat feature information.

[0033] This application also provides a model training set generation apparatus, comprising:

[0034] The generation unit is used to generate corresponding threat data templates based on the original network threat data.

[0035] A generalization unit is used to generalize the variables in the threat data template to generate first network threat data;

[0036] The obfuscation unit is used to obfuscate the first network threat data to obtain obfuscated second network threat data;

[0037] The assembly unit is used to assemble the second network threat data and normal network data to obtain model training data.

[0038] This application also provides a model training set generation apparatus, comprising:

[0039] Central processing unit, memory, input / output interface, wired or wireless network interface, power supply;

[0040] The memory is either a short-term storage memory or a persistent storage memory;

[0041] The central processing unit is configured to communicate with the memory and execute instructions in the memory on the control plane functional entity to perform the above-described generation method.

[0042] This application also provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the generation method as described above.

[0043] This application also provides a computer program product comprising a computer program, characterized in that, when the computer program product is run on a computer, the computer executes the prompt word optimization method as described above.

[0044] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0045] In this embodiment, a corresponding threat data template is generated based on the original network threat data; the variables in the threat data template are generalized to generate first network threat data; the first network threat data is obfuscated to obtain obfuscated second network threat data; the second network threat data and normal network data are assembled to obtain model training data.

[0046] It is evident that by generalizing the variables in the threat data template to generate the first network threat data, and by obfuscating the first network threat data, a variable and unpredictable second network threat data can be generated. By assembling the second network threat data and normal network data, the resulting model training data can be made diverse and can comprehensively reflect the constantly evolving network attack methods. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0048] Figure 1 This is a flowchart illustrating the generation process of a model training set as disclosed in an embodiment of this application;

[0049] Figure 2 This is a flowchart illustrating the generation process of another model training set disclosed in an embodiment of this application;

[0050] Figure 3 This is a schematic diagram of a model training set generation device disclosed in an embodiment of this application;

[0051] Figure 4 This is a schematic diagram of another model training set generation device disclosed in an embodiment of this application. Detailed Implementation

[0052] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0053] In the description of the embodiments of this application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the embodiments of this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of this application.

[0054] In the description of the embodiments of this application, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the embodiments of this application based on the specific circumstances.

[0055] Existing web attacks include, but are not limited to: SQL injection, XSS (Cross-Site Scripting), CSRF (Cross-Site Request Forgery), file uploads, invalid function-level authorization, invalid user authentication, invalid object-level authorization, excessive data exposure, and bulk assignment. In web attacks, attackers often attack web application services by sending network threat data, attempting to tamper with data, obtain sensitive information, or perform unauthorized operations. This network threat data can be malicious network data, payload data (malicious code), malicious traffic, etc. This network threat data can directly affect the security and data integrity of the target system; it can be code used to execute malicious operations or specific data used to exploit system vulnerabilities.

[0056] To enable large language models to identify cyber threat data, they need to be trained using a training set corresponding to the cyber threat data. Traditionally, the generation of model training data relies primarily on cybersecurity personnel manually collecting and labeling cyber threat data from the internet. However, due to limitations in the knowledge of cybersecurity personnel, the collection tends to focus on cyber threats corresponding to known attack methods, and the collected cyber threat data is usually relatively common. This results in a lack of diversity in the generated model training data, making it difficult to cover unknown cyber attack methods and their variants. Consequently, the generated model training data cannot comprehensively reflect the constantly evolving cyber attack methods, making it difficult for large language models trained on this data to detect unknown cyber attack methods and their variants. Therefore, this application provides a method for generating a model training set that ensures the obtained model training data is diverse and can comprehensively reflect the constantly evolving cyber attack methods, such as... Figure 1 As shown, the specific steps include the following:

[0057] 101. Generate corresponding threat data templates based on the original network threat data.

[0058] In this embodiment, the model training set generation device can acquire raw network threat data and generate corresponding threat data templates based on the raw network threat data. This raw network threat data can be widely distributed network threat data on the Internet, containing a large amount of network threat data, including attack traffic, malicious payloads, vulnerabilities, and threat intelligence in the field of network security, etc., without specific limitations here. Raw network threat data can be collected through live network methods or manual methods, without specific limitations here. Live network methods refer to automatically collecting raw network threat data through network security tools deployed in a real network environment, such as capturing attack traffic in the network in real time through firewalls or intrusion detection systems. Automatic collection of raw network threat data through live network methods can efficiently collect raw network threat data. Manual methods refer to receiving raw network threat data sent by network security personnel and manually obtaining it according to specific needs, such as when network security personnel analyze ransomware attacks, they manually extract malicious payloads from infected hosts and transmit the malicious payloads to the model training set generation device.

[0059] After acquiring raw network threat data, data processing can be performed to generate corresponding threat data templates. This involves structuring the raw network threat data to generate the templates. The raw network threat data includes its format and variables, and threat data templates can be generated based on these formats and variables. The model training set generation device automatically processes the raw network threat data, determining the corresponding threat data templates. This reduces manual intervention, improves the speed and quality of data processing, and increases the speed of threat data template generation.

[0060] After determining the threat data template corresponding to the original network threat data, the threat data template can be instantiated. Instantiating the threat data template includes generalization and secondary processing of the threat data template. The generalization process is shown in step 102 below, and the secondary processing process is shown in step 103 below.

[0061] 102. Generalize the variables in the threat data template to generate the first network threat data.

[0062] After generating the threat data template corresponding to the original network threat data, the variables in the threat data template can be generalized to generate the first network threat data. This generalization process involves generalizing the variables in the threat data template into specific data, thereby generating executable first network threat data (such as code or a specific object). Specifically, the value range of the variables in the threat data template can be determined, and variable values ​​within this range are selected and filled into the threat data template to generate the first network threat data. It is understood that the value ranges for different variables differ, requiring the definition of corresponding value ranges for different variables. After determining the value range of the variables in the threat data template, variable values ​​are selected and filled into the threat data template to generate the first network threat data. Preferably, for each variable in the threat data template, a variable value is randomly selected from its corresponding value range and filled into the corresponding position, generating multiple random first network threat data. By randomly selecting variable values ​​from the value range and filling them into the threat data template, the generated first network threat data can have multiple possibilities, resulting in varied first network threat data.

[0063] 103. Obfuscate the first network threat data to obtain the obfuscated second network threat data.

[0064] After generating the first network threat data, it can be obfuscated to obtain the obfuscated second network threat data. Obfuscation primarily refers to modifying the surface appearance of the network threat data (such as character replacement, encoding conversion, and structural reorganization) to hide the malicious characteristics or original logic of the first network threat data without altering its core function (such as the threat objective). This makes the obfuscated first network threat data more concealed and allows for more effective bypassing of protection mechanisms, thus generating unpredictable second network threat data.

[0065] 104. Assemble the second network threat data and normal network data to obtain model training data.

[0066] After obtaining the obfuscated second network threat data, it can be assembled with normal network data to obtain model training data. Normal network data is generated to achieve normal network functions (such as browsing web pages, transferring files, user login, etc.) and does not pose a threat to network devices, servers, or user information; that is, the second network threat data can be embedded into normal network data to generate model training data. This generated model training data is also network threat data (i.e., malicious network data). By assembling the second network threat data and normal network data, real network attack scenarios can be simulated, making the obtained model training data more consistent with real network threat data and increasing the model training data's ability to resist security protection systems. In other words, in this embodiment, the device for generating the simulated training set can automatically generate model training data using the original network threat data. The generated model training data is diverse (i.e., rich) and consistent with real network attack scenarios, so that the large language model trained using the model training data can accurately detect unknown network attack methods and variations of network attack methods.

[0067] In this embodiment, a corresponding threat data template is generated based on the original network threat data; the variables in the threat data template are generalized to generate first network threat data; the first network threat data is obfuscated to obtain obfuscated second network threat data; the second network threat data and normal network data are assembled to obtain model training data.

[0068] It is evident that by generalizing the variables in the threat data template to generate the first network threat data, and by obfuscating the first network threat data, a variable and unpredictable second network threat data can be generated. By assembling the second network threat data and normal network data, the model training data can be made diverse and can comprehensively reflect the constantly evolving network attack methods.

[0069] Furthermore, the process of generating the model training set will be described in detail below, such as... Figure 2 As shown, the specific steps include the following:

[0070] 201. Extract common features from the original network threat data of targets with the same threat type and threat purpose, and generate threat data templates.

[0071] In this embodiment, after obtaining the original network threat data, common features of target original network threat data with the same threat type and threat purpose can be extracted to generate a threat data template. The threat type can be called a vulnerability type or attack type. The threat type corresponding to the original network threat data can be: SQL injection, command injection, Java code injection, PHP code injection, Java deserialization, Webshell upload, etc., without specific limitations here; the original network threat data can be classified according to threat type. The threat purpose (which can be called the attack purpose) corresponding to the original network threat data can be: obtaining sensitive information, controlling the system, stealing data, damaging the system, etc., without specific limitations here; each piece of original network threat data can be statistically analyzed based on threat type and threat purpose.

[0072] Next, from the original network threat data, target original network threat data with the same threat type and threat purpose are identified; common features of the target original network threat data are extracted to generate a threat data template corresponding to the target original network threat data. That is, for original network threat data with the same threat type and the same threat purpose, common features are extracted, personalized content (such as specific IPs, accounts, etc.) in the original network threat data is removed, and a standardized threat data template is formed.

[0073] For example, the threat type is SQL injection, and the threat objective is to steal data. The original network threat data could be: A, o1' OR '1'='1 UNION SELECT username,password FROM users--

[0074] B. admin' AND 1=2 UNION SELECT id,pass FROM user_list--

[0075] At this point, after extracting common features from threat data A and B, the generated threat data template is: [Any character]'OR [Logical judgment] UNION SELECT [Sensitive field] FROM [Data table]--.

[0076] In this embodiment, by extracting common features from the original network threat data of targets with the same threat type and threat purpose, a threat data template can be generated, which can obtain the threat data template more accurately and thus improve the accuracy of the training data for the generated model.

[0077] 202. Determine the value range of the variables in the threat data template, randomly select variable values ​​from the value range and fill them into the threat data template to generate the first network threat data.

[0078] After generating the threat data template, the value range of the variables in the template can be determined. Variable values ​​are then randomly selected from this range and entered into the threat data template to generate network attack data. It is necessary to define corresponding value ranges for different variables to ensure that the value ranges accurately match the corresponding variable characteristics, thus better reflecting actual network attack scenarios.

[0079] Specifically, when the variable in the threat data template is a system command, its value range is a preset list of system commands. For example, if the system command corresponds to Linux, the preset list of system commands is a list of commonly used Linux commands, including: ls (view directory), cat (read file), rm (delete file), whoami (view current user), ifconfig (view network), etc.; if the system command corresponds to Windows, the preset list of system commands is a list of commonly used Windows commands, including: dir (view directory), type (read file), del (delete file), whoami (view current user), ipconfig (view network), etc. When the variable in the threat data template is a string, its value range is a preset string dictionary, which is a dictionary of commonly used strings, such as ordinary text: user123, productABC, order number2024001; special character combinations: !, @, #, $, %, &. When the variable in the attack threat data template is a parameter, its value range is determined based on the attack threat type and threat purpose of the threat data template; this ensures that the variable value corresponding to the parameter matches the threat type and threat purpose, triggering the corresponding network attack. For example, for attack data templates with the threat type of SQL injection and the threat purpose of stealing data, when the parameter variable is a table name, the corresponding value range is: user tables in the system: users, user_info, member; when the parameter variable is a field name, the corresponding value range is: fields in the user table that store sensitive information: username, password, phone, email.

[0080] 203. Obfuscate the first network threat data and determine the valid second network threat data in the obfuscated network threat data.

[0081] After generating the first network threat data, it can be obfuscated to identify valid second network threat data within the obfuscated dataset. Specifically, the first network threat data can be obfuscated using one or more of the following methods: encoding obfuscation, string obfuscation, and syntax obfuscation. Obfuscating the first network threat data using any one or more of these methods can effectively improve the diversity of the second network threat data. Encoding obfuscation can involve using base64, URL encoding, etc.; string obfuscation can involve using synonym replacement, inserting spaces, etc.; and syntax obfuscation can involve using syntax variation, etc.

[0082] Next, the validity of the obfuscated network threat data can be tested to identify valid secondary network threat data within the obfuscated dataset. This involves testing whether the obfuscated network threat data can achieve a network attack. If it can, the obfuscated network threat data is considered valid; otherwise, it is considered invalid. Fuzzing tools can be used to test the validity of the obfuscated network threat data. By identifying valid secondary network threat data within the obfuscated dataset, the accuracy of the secondary network threat data can be ensured, preventing the template training set from including invalid network threat data.

[0083] 204. After storing the labeled second network threat data into the database, retrieve the target network threat data from the database based on the query request.

[0084] Understandably, current methods of manually collecting cyber threat data from the internet require specialized cybersecurity expertise, making it difficult to outsource or delegate to non-specialists. This limits data collection speed and reduces efficiency. In this application, after obtaining obfuscated second cyber threat data, the tagged data can be stored in a database, and target cyber threat data can be retrieved from the database based on query requests. By systematically managing and storing the tagged second cyber threat data in a database, an easy-to-query and use database can be built, lowering the professional barrier in the security field. Even non-specialists without security knowledge can efficiently retrieve and utilize the second cyber threat data in the database to generate model training sets according to their needs. This allows multiple outsourced personnel or non-specialists to collaborate, improving data collection speed and efficiency.

[0085] Specifically, the system can assign corresponding threat tag information to the second network threat data. This threat tag information includes a threat type tag and a threat purpose tag. The tagged second network threat data is then stored in a database. The system receives query requests for target network threat data. These requests can be sent by cybersecurity personnel or non-professionals. The query requests contain threat characteristic information of the target network threat data, including threat type information and threat purpose information. Based on the threat characteristic information of the target network threat data in the query request and the threat tag information of the second network threat data, the system retrieves the target network threat data from the database. In other words, the system matches the threat characteristic information in the query request with the threat tag information of the second network threat data in the database to obtain the retrieved target network threat data.

[0086] 205. Based on the target threat data template corresponding to the target network threat data, normal network data is assembled to obtain model training data.

[0087] Next, normal network data can be assembled based on the target threat data template corresponding to the queried target network threat data to obtain model training data. Specifically, the target threat data template corresponding to the queried target network threat data can be determined; the queried target network threat data and normal network data are filled into the target threat data template to obtain model training data. This model training data includes both the queried target network threat data and normal network data. By assembling normal network data using the target threat data template corresponding to the queried target network threat data to obtain model training data, the process of generating model training data is simplified. Even non-experts can quickly assemble the queried target network threat data and normal network data to obtain model training data, effectively improving the efficiency of model training data generation.

[0088] 206. Based on the completed threat identification model, label the model training data with the corresponding threat feature information.

[0089] Understandably, existing methods for generating model training data primarily rely on cybersecurity personnel manually labeling network attack data, which is easily influenced by their subjective judgment and reduces the accuracy of the labeling. However, in this embodiment, based on a trained threat identification model, the model training data is labeled with corresponding threat feature information. This automated labeling by the threat identification model avoids the influence of subjective judgment by cybersecurity personnel and improves the accuracy of the model training data labeling.

[0090] Specifically, a threat identification model pre-trained based on normal network data and network threat data can be obtained. This threat identification model can be a convolutional neural network (CNN), a recurrent neural network (RNN / LSTM / GRU), or a Transformer model (based on an attention mechanism); the specific model is not limited here. Next, the threat identification model can be used to annotate the model training data with corresponding threat feature information. That is, the threat identification model automatically annotates the model training data, indicating the corresponding threat type, threat purpose, and attack payload, among other threat feature information.

[0091] This application also provides a device for generating a model training set, such as... Figure 3 As shown, it includes:

[0092] The generation unit 301 is used to generate a corresponding threat data template based on the original network threat data;

[0093] Generalization unit 302 is used to generalize the variables in the threat data template to generate first network threat data;

[0094] The obfuscation unit 303 is used to obfuscate the first network threat data to obtain obfuscated second network threat data.

[0095] Assembly unit 304 is used to assemble the second network threat data and normal network data to obtain model training data.

[0096] This application embodiment also provides a model training set generation device 400, such as... Figure 4 As shown, the generation apparatus 400 of this application embodiment may include one or more central processing units (CPUs) 401 and a memory 402, wherein the memory 402 stores one or more applications or data.

[0097] The memory 402 can be volatile or persistent storage. The program stored in the memory 402 can include one or more modules, each module including a series of instruction operations on the electronic device. Furthermore, the central processing unit 401 can be configured to communicate with the memory 402 and execute the series of instruction operations stored in the memory 402 on the elevator operation control device 600.

[0098] The generating device 400 may also include one or more power supplies 405, one or more wired or wireless network interfaces 404, one or more input / output interfaces 403, and / or one or more operating systems, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0099] The central processing unit 401 can perform the operations performed by the first aspect or any specific method embodiment of the first aspect, which will not be described in detail here.

[0100] This application also provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the method described above.

[0101] This application also provides a computer program product comprising a computer program, characterized in that, when the computer program product is run on a computer, the computer executes the generation method described above.

[0102] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0103] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0104] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0105] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0106] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for generating a model training set, characterized in that, include: Generate corresponding threat data templates based on raw network threat data; The variables in the threat data template are generalized to generate the first network threat data; The first network threat data is obfuscated to obtain obfuscated second network threat data; The second network threat data and normal network data are assembled to obtain model training data.

2. The generation method according to claim 1, characterized in that, The generation of the corresponding threat data template based on the original network threat data includes: Among the original network threat data, target original network threat data with the same threat type and threat purpose are identified; Extract common features from the target's original network threat data to generate a threat data template corresponding to the target's original network threat data.

3. The generation method according to claim 1, characterized in that, The generalization process of the variables in the threat data template to generate the first network threat data includes: Determine the value range of the variables in the threat data template; Randomly select variable values ​​from the range and fill them into the threat data template to generate the first network threat data.

4. The generation method according to claim 3, characterized in that, Determining the value range of the variables in the threat data template includes: When the variable in the threat data template is a system command, the value range of the variable is the preset system command list; When the variable in the threat data template is a string, the value range of the variable is a preset string dictionary; When the variables in the threat data template are parameters, the range of values ​​for the variables is determined based on the threat type and threat purpose of the threat data template.

5. The generation method according to claim 1, characterized in that, The obfuscation of the first network threat data to obtain obfuscated second network threat data includes: The first network threat data is obfuscated using any one or more of the following obfuscation methods: encoding obfuscation, string obfuscation, and syntax obfuscation, to obtain obfuscated network threat data. Test the validity of obfuscated network threat data and identify valid secondary network threat data within the obfuscated network threat data.

6. The generation method according to claim 1, characterized in that, After obfuscating the first network threat data to obtain obfuscated second network threat data, the method further includes: After assigning corresponding threat tag information to the second network threat data, it is stored in the database; The step of assembling the second network threat data and normal network data to obtain model training data includes: Receive a query request for target network threat data, and retrieve the target network threat data from the database based on the threat feature information of the target network threat data and the threat tag information of the second network threat data in the query request; Determine the target threat data template corresponding to the target network threat data; The target network threat data and the normal network data are filled into the target threat data template to obtain the model training data.

7. The generation method according to claim 1, characterized in that, After assembling the second network threat data and normal network data to obtain model training data, the method further includes: Obtain a threat identification model that has been pre-trained based on normal network data and network threat data; Based on the threat identification model, the training data of the model is labeled with corresponding threat feature information.

8. A device for generating a model training set, characterized in that, include: The generation unit is used to generate corresponding threat data templates based on the original network threat data. A generalization unit is used to generalize the variables in the threat data template to generate first network threat data; The obfuscation unit is used to obfuscate the first network threat data to obtain obfuscated second network threat data; The assembly unit is used to assemble the second network threat data and normal network data to obtain model training data.

9. A device for generating a model training set, characterized in that, include: Central processing unit, memory, input / output interface, wired or wireless network interface, power supply; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory on a control plane functional entity to perform the generation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the generation method as described in any one of claims 1 to 7.

Images