Internet situation awareness system and method based on large model, and storage medium
By constructing a situational awareness system based on a large model, the problems of insufficient generalization ability and interpretability of situational awareness systems are solved, achieving more intelligent, transparent and adaptive situational awareness, and improving the accuracy and efficiency of decision-making.
Patent Information
- Application Number
- CN202511514370.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-22
- Publication Date
- 2026-01-23
AI Technical Summary
Existing situational awareness analysis systems have weak generalization capabilities in dealing with new situations, cannot explain high decision-making transparency, and cannot use external knowledge to identify complex attacks.
Construct an internet situational awareness system based on a large model, including a construction module, a recommendation module, and an iteration module. The system uses the large model to perform situational awareness, generate recommendation results and decision reasons, and optimize the prompt word library based on user evaluations.
It improves the system's intelligence, transparency, and adaptability, enabling it to more accurately identify threats and provide clear decision-making recommendations, thereby enhancing decision-making trust and response efficiency.
Smart Images
Figure CN121390884A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application belongs to the technical field of situation awareness, and particularly relates to an Internet situation awareness system based on a large model, a method thereof and a storage medium. BACKGROUND
[0002] At present, the idea of realizing the recommendation function of the situation awareness analysis system is to recommend suitable basic information and related content to different department personnel based on the massive data of user portraits and historical behaviors. However, with the rapid increase of department business demands, the situation awareness analysis system requires higher coverage of the ability of the precise recommendation system.
[0003] In actual use, the situation awareness analysis system using the traditional recommendation model generally has several important problems: first, the generalization ability to cope with new situations is weak. The traditional model, especially the deep learning model, is not good at processing and training samples with large distribution differences. When a network attack using new artificial intelligence technology occurs, the system cannot identify and predict due to the lack of historical data. The system cannot adapt to the rapidly changing business environment and threat situation, and is easily outdated, requiring frequent and expensive manual model updates.
[0004] Second, the explainability, that is, the decision transparency, is very weak. The system can only give a conclusion of what it is, such as high risk, but cannot explain why. For example, the system labels an employee as high risk, but the security administrator does not know whether it is based on his late-night login, large data download, or other reasons. This leads to low decision trust, and analysts are difficult to judge the authenticity of the alarm, which may cause false alarms to be ignored or real responses to be delayed. Due to the inability to provide a clear investigation direction, the disposal efficiency is greatly reduced.
[0005] Third, only the data labeled and trained inside the system can be used, and the general knowledge outside the model cannot be used. When facing complex and hidden multi-step attacks, the lack of common sense and logical reasoning ability limits the recognition ability.
[0006] Based on the above problems, a new situation awareness system is urgently needed. SUMMARY
[0007] In order to provide a more intelligent, more transparent and more adaptive situation awareness system, in the first aspect, the present application provides an Internet situation awareness system based on a large model, characterized in that the system comprises: The construction module is configured to obtain user portraits and user behavior data from received raw data, detect the user portraits and the user behavior data according to a default threshold, generate event early warning information, regional early warning information and organizational early warning information according to three types of rules, namely, event early warning rules, regional early warning rules and organizational early warning rules, and input the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness. The recommendation module is configured to obtain a recommendation result and a decision reason output by the large model, wherein the recommendation result includes a risk level, an object of attention and an action suggestion, and the decision reason includes a reason formed by explaining the recommendation result in natural language, and assemble the recommendation result and the decision reason according to different business scenarios. The iteration module is configured to record input of the large model, the recommendation result and user evaluation, score the input of the large model in descending order according to the recommendation result and the user evaluation, and extract prompt words with the highest scores in events, regions and organizations to optimize a prompt word library of the large model. In a possible implementation, the inputting of the event early warning information, the regional early warning information and the organizational early warning information into the large model for situation awareness includes: obtaining an interaction path description and rules based on the event early warning information, the regional early warning information and the organizational early warning information, wherein the interaction path description is a specific behavior sequence of a prewarning object, and the rules are default configurations and early warning rules for triggering current early warning information; converting the interaction path description and the rules into a natural language form according to the prompt word library, and inputting the interaction path description and the rules into the large model in the form of text features.
[0008] In a possible implementation, the assembling of the recommendation result and the decision reason according to different business scenarios includes: for an internal threat monitoring scenario, assembling personnel information, a department to which the personnel belong and a behavior sequence in the recommendation result and the decision reason; for a network attack monitoring scenario, assembling an attack source address, an attack type and an affected asset in the recommendation result and the decision reason; for a regional security monitoring scenario, assembling a risk region in the recommendation result and the decision reason.
[0009] In a possible implementation, the recommendation module is further configured to, when the object of attention is an organization, if the risk level is a high level, the action suggestion is to solve immediately, if the risk level is a medium level, the action suggestion is to send staff to pay attention to, and if the risk level is a low level, the action suggestion is to pay attention to continuously.
[0010] In a possible implementation, the large model is fine-tuned by the following steps: extracting historical user portrait and historical user behavior data from the situational awareness system database, obtaining historical interaction path description and historical rules based on the historical user portrait and the historical user behavior data, and converting the historical interaction path description and the historical rules into text features in natural language form; training the base large model using the text features, and adjusting the large model parameters to make the large model output consistent with the expected recommendation results and decision reasons.
[0011] In a second aspect, the present application provides an internet situational awareness method based on a large model, which comprises: obtaining user portrait and user behavior data from received raw data, detecting the user portrait and the user behavior data according to a default threshold, generating event warning information, regional warning information and organizational warning information according to three types of rules, i.e., event warning rules, regional warning rules and organizational warning rules, and inputting the event warning information, the regional warning information and the organizational warning information into a large model for situational awareness; obtaining recommendation results and decision reasons output by the large model; the recommendation results include risk level, attention objects and action suggestions, and the decision reasons include reasons explained in natural language; and assembling the recommendation results and the decision reasons according to different business scenarios; recording the input of the large model, the recommendation results and user evaluation, performing descending order scoring on the input of the large model according to the recommendation results and the user evaluation, and extracting the highest scoring prompt words in events, regions and organizations for optimizing the prompt word library of the large model. In a possible implementation, the inputting of the event warning information, the regional warning information and the organizational warning information into the large model for situational awareness comprises: obtaining interaction path description and rules based on the event warning information, the regional warning information and the organizational warning information; the interaction path description is a specific behavior sequence of the warning object, and the rules are default configurations and warning rules for triggering the current warning information; converting the interaction path description and the rules into natural language form according to the prompt word library, and inputting the text features into the large model.
[0012] In a possible implementation, the assembling of the recommendation results and the decision reasons according to different business scenarios comprises: for internal threat monitoring scenarios, assembling personnel information, department affiliation and behavior sequence in the recommendation results and the decision reasons; For a network attack monitoring scenario, the attack source address, attack type and affected asset in the recommendation result and decision reason are assembled; For a regional security monitoring scenario, the risk region in the recommendation result and decision reason is assembled.
[0013] In a possible implementation, the method further includes: When the object of attention is an organization, if the risk level is a high level, the action suggestion is to solve immediately; if the risk level is a medium level, the action suggestion is to send staff to pay attention; if the risk level is a low level, the action suggestion is to continue to pay attention.
[0014] In a third aspect, the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above internet situation awareness methods based on a large model.
[0015] The internet situation awareness system based on a large model provided by the embodiments of the present application comprises: a construction module, configured to obtain user portraits and user behavior data from received raw data, and detect the user portraits and the user behavior data according to a default threshold; generate event early warning information, regional early warning information and organizational early warning information according to three types of rules, namely event early warning rules, regional early warning rules and organizational early warning rules; input the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness; a recommendation module, configured to obtain a recommendation result and a decision reason output by the large model; the recommendation result comprises a risk level, an object of attention and an action suggestion, and the decision reason comprises reasons formed by explaining the recommendation result in natural language; the recommendation result and the decision reason are assembled according to different business scenarios; an iteration module, configured to record inputs of the large model, the recommendation result and user evaluation, and perform descending order scoring on the inputs of the large model according to the recommendation result and the user evaluation; extract prompt words with the highest score in events, regions and organizations, and use the prompt words to optimize a prompt word library of the large model. By using the generalization ability and rich external knowledge of the large model, more accurate recommendation results can be given when processing recommendation tasks including events, regions and organizations, and decision reasons are generated at the same time, so that the situation awareness system is more intelligent, more transparent and more adaptive. BRIEF DESCRIPTION OF DRAWINGS
[0016] Figure 1 The first system structure diagram of the internet situation awareness system based on a large model provided by the embodiments of the present application; Figure 2 The second system structure diagram of the internet situation awareness system based on a large model provided by the embodiments of the present application; Figure 3 A first flowchart of a large model-based Internet situation awareness method provided for an embodiment of the present application is shown in FIG. 1. Figure 4 A second flowchart of a large model-based Internet situation awareness method provided for an embodiment of the present application is shown in FIG. 2. DETAILED DESCRIPTION
[0017] The present application will be described in detail below through embodiments.
[0018] The current situation awareness analysis system implements the recommendation function based on the massive data of user portraits and historical behaviors, and recommends suitable basic information and related content to different department personnel. However, with the rapid increase of department business needs, the situation awareness analysis system requires higher coverage of the precision recommendation system.
[0019] In actual use, the situation awareness analysis system using the traditional recommendation model has several important problems: first, the generalization ability to deal with new situations is weak. Traditional models, especially deep learning models, are not good at handling new business needs with large differences in training sample distribution. When a network attack using new artificial intelligence technology occurs, the system cannot identify and predict due to the lack of historical data. The system cannot adapt to the rapidly changing business environment and threat situation, and is easily outdated, requiring frequent and expensive manual model updates.
[0020] Second, the explainability, i.e., decision transparency, is very weak. The system can only give a conclusion of what it is, such as high risk, but cannot explain why. For example, the system labels an employee as high risk, but the security administrator does not know whether it is based on his late-night login, large data download, or other reasons. This leads to low decision trust and difficulty for analysts to judge the authenticity of the alarm, which may result in false positives being ignored or real responses being delayed. Due to the inability to provide clear investigation directions, the disposal efficiency is greatly reduced.
[0021] Third, only the data labeled and trained inside the system can be used, and the general knowledge outside the model cannot be used. When facing complex and hidden multi-step attacks, the system lacks common sense and logical reasoning ability, and has limited recognition ability.
[0022] Based on the above problems, a new situation awareness system is needed.
[0023] In a first aspect, referring to Figure 1 The embodiments of the present application provide a large model-based Internet situation awareness system, which comprises: The construction module 101 is used to obtain user portrait and user behavior data from the received raw data, detect the user portrait and the user behavior data according to a default threshold, generate event early warning information, regional early warning information and organizational early warning information according to three types of rules of event early warning rules, regional early warning rules and organizational early warning rules, and input the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness. Raw data is all unprocessed signals received by the situation awareness system, including network data such as access logs, traffic data, login records, user behavior data such as operation logs, file access records, online duration, and system data such as error reports and performance indicators.
[0024] The default threshold is used for preliminary screening of raw data to quickly scan out out-of-bound early warning objects, for example, for the event early warning object, the default threshold can be that the single session download data volume does not exceed 1 GB. After detecting the raw data by using the default threshold, a suspicious object list is obtained, for example, the system scans the login data of 10,000 employees and finds that the single-day login times of employee A are 100 times, which exceeds the default threshold, so the system generates a to-be-processed data about employee A. It should be noted that different business scenarios are different, such as different activity times of user behavior, different analysis results, and a possible example is that during 8:00-20:00, the default threshold is that the single session download data volume does not exceed 10 GB, and during 0:00-8:00 and 20:00-24:00, the default threshold is that the single session download data volume does not exceed 1 GB.
[0025] The early warning rule is more complex and intelligent than the default threshold, which is no longer a single number but a set of logical judgments, which will perform in-depth analysis on the suspicious objects generated in the previous step, for example, an event early warning rule can be: large download volume and access to core database, then trigger suspected data theft early warning. Each early warning object is judged according to three types of rules of event early warning rules, regional early warning rules and organizational early warning rules, if all conditions are met, the system will formally generate an early warning. For example, the system substitutes the data of employee A into the rules and finds that he has logged in 150 times and all of them are in the early morning, and the IP comes from overseas, which completely matches the suspected account theft rule, so the system formally generates an early warning: alarm! Employee A's account is at risk of being stolen.
[0026] Among them, the event can be a login event, the region can be an IP address segment or a physical access control area, and the organization can be a department or a project team.
[0027] The recommendation module 102 is configured to obtain a recommendation result and a decision reason of the large model output, wherein the recommendation result comprises a risk level, an attention object and an action suggestion, and the decision reason comprises a reason explained by natural language.
[0028] The attention object refers to a specific region, organization or event that needs to be focused on, and the action suggestion is implied in the risk level, such as immediate handling, key attention or continuous monitoring.
[0029] In one example, when the attention object is an organization, if the risk level is high, the action suggestion is to solve immediately; if the risk level is medium, the action suggestion is to send staff for key attention; and if the risk level is low, the action suggestion is to continue to pay attention.
[0030] The recommendation result converts the unstructured model output into clear decision suggestions that can be directly understood by business personnel. One possible decision reason can be that the behavior meets three abnormal conditions of A, B and C at the same time, and is highly consistent with a known attack pattern. This greatly enhances the explainability and credibility of the system, allowing analysts to understand the reasons behind the recommendation result and thus take action more quickly and accurately.
[0031] The assembly process of the recommendation module usually includes the following aspects. Information extraction and structuring: from the text returned by the large model, extract key entities and information points, such as extracting objects (people, IP addresses, department names), extracting behaviors (login, download, access), extracting conclusions (high risk, medium risk, low risk), extracting reasons, and extracting suggestions. According to the business scenario to which the early warning information belongs, use different report templates for presentation.
[0032] In one example, for the internal threat monitoring scenario, the personnel information, department to which the personnel belong and behavior sequence in the recommendation result and decision reason are assembled; For the network attack monitoring scenario, the attack source address, attack type and affected assets in the recommendation result and decision reason are assembled; For the regional security monitoring scenario, the risk region in the recommendation result and decision reason is assembled.
[0033] The iteration module 103 is configured to record the input of the large model, the recommendation result and user evaluation, and to score the input of the large model in descending order according to the recommendation result and user evaluation; and to extract the prompt words with the highest scores in events, regions and organizations, for optimizing the prompt word library of the large model.
[0034] The user can give a good comment or a bad comment on the recommendation result of the large model each time. The large model prompt word is fine-tuned according to the good comment and the bad comment of the user evaluation, and is fed back to the large model, so that the recommendation result is more accurate, and the large model prompt word is automatically optimized. The accuracy of the recommendation result and the decision reason is improved, the work effect is improved, and the deficiency in efficiency can be effectively solved.
[0035] The large model-based Internet situation awareness system provided by the embodiment of the application comprises: a construction module, configured to acquire user portraits and user behavior data from received original data, detect the user portraits and the user behavior data according to a default threshold, generate event early warning information, regional early warning information and organizational early warning information according to three types of rules, namely, event early warning rules, regional early warning rules and organizational early warning rules, input the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness, a recommendation module, configured to acquire a recommendation result and a decision reason output by the large model, wherein the recommendation result comprises a risk level, an object of attention and an action suggestion, and the decision reason comprises a reason formed by explaining the recommendation result in natural language, and the recommendation module is configured to assemble the recommendation result and the decision reason according to different business scenarios, and an iteration module, configured to record input of the large model, the recommendation result and user evaluation, score the input of the large model in descending order according to the recommendation result and the user evaluation, and extract prompt words with the highest scores in events, regions and organizations to optimize a prompt word library of the large model. The generalization ability and rich external knowledge of the large model are utilized, and when a recommendation task including events, regions and organizations is processed, more accurate recommendation results can be given, and decision reasons can be generated, so that the situation awareness system is more intelligent, more transparent and more adaptive.
[0036] In one example, the construction module 101 is specifically configured to acquire an interaction path description and rules based on the event early warning information, the regional early warning information and the organizational early warning information, wherein the interaction path description is a specific behavior sequence of a pre-warning object, and the rules are pre-warning rules and default configurations on which the current pre-warning information is triggered. The interaction path description and the rules are converted into a natural language form according to the prompt word library, and are input into the large model in the form of text features.
[0037] The specific behavior sequence of the pre-warning object contains specific information about who does what at what time and how the result is, and the interaction path description and the rules form a complete context, which tells the large model that there is a situation, and it is considered suspicious according to the rules. Specifically, the process is further understood through the following example: Step 1: The construction module generates an original pre-warning, and the pre-warning information is ID-20240601-001: Employee A-high risk internal threat. Step 2, obtain the interaction path description and rules, convert the interaction path description and the rules into natural language form according to the prompt word library, input the text features into the large model, and the following is a possible large model input. Warning object: Employee A (Technical Department).
[0038] Behavior sequence: On June 1, 2:15 a.m., logged in to VPN from foreign IP 1.2.3.4; 2:20, accessed the customer database server; 2:25-2:30, downloaded 3 files containing customer privacy information in bulk, totaling 5GB.
[0039] According to company security policy article 3.2: any large-scale download behavior of sensitive data initiated from untrusted geographic areas outside working hours (10 p.m.-6 a.m.) is considered high risk.
[0040] The input of the large model is the prompt word input. The application optimizes the prompt word library of the large model by obtaining the prompt word with the highest score in the event, region, and organization. In subsequent situation awareness tasks, the implementation effect of inputting the interaction path description and the rules into the large model in the form of text features according to the prompt word library will be greatly improved.
[0041] In one example, the large model is fine-tuned by the following steps: Extract historical user portrait and historical user behavior data from the situation awareness system database, and based on the historical user portrait and the historical user behavior data, obtain historical interaction path description and historical rules, and convert the historical interaction path description and the historical rules into text features in natural language form; Train the base large model using the text features, and adjust the large model parameters to make the large model output consistent with the expected recommendation results and decision reasons.
[0042] After fine-tuning, the large model can give recommendation results and decision reasons when facing prompt word text feature input.
[0043] Referring to Figure 2 The second Internet situation awareness system based on a large model provided by the application is shown in the figure. The construction module includes warning objects, default configurations, and warning rules, which are used to generate warning information according to the warning objects, default configurations, and warning rules; the recommendation module includes recommended events, recommended regions, and recommended organizations, which specify whether events or regions or organizations need to be paid attention to; the iteration module includes analyzing recommendation results, analyzing user evaluations, and fine-tuning prompts, which are used to optimize the prompts according to the recommendation results and user evaluations. After that, when inputting the large model, the prompts that have been confirmed to achieve good results can be selected.
[0044] Referring to Figure 3 A workflow diagram of a construction module is provided for the present application. After obtaining the original data, it is divided into three categories according to events, regions and organizations. The warning information of the event is generated according to the warning rules of the event, the warning information of the region is generated according to the warning rules of the region, and the warning information of the organization is generated according to the warning rules of the organization. The warning information analysis is carried out based on the warning information of the event, the warning information of the organization and the warning information of the region.
[0045] Referring to Figure 4 A large model-based Internet situation awareness method flowchart is provided for the present application. After the above warning information analysis, construction module 1, construction module 2 and construction module 3 are formed. The construction module is not a single one, each construction module is configured around people, events, places, things and organizations, and is composed of multiple construction modules, which are construction module 1, construction module 2 and construction module 3, etc. The default configuration of construction module 1 is a behavior analysis module for people, which generates default data according to 24-hour grouping, and the default data is used for warning rules. After the data of the construction module is input into the large model, the recommended results and decision reasons are obtained, and the recommended module 1, the recommended module 2 and the recommended module 3 are formed after classification according to the events, the regions and the organizations. There are corresponding high, medium and low recommendation levels in the recommended events, the recommended regions and the recommended organizations, such as the following categories of recommended levels for organizations.
[0046] High level: The organization recommendation has more than 10 people, and hits the corresponding rules, which belongs to major risks that need to be solved immediately.
[0047] Medium level: The organization recommendation has 5-10 people, and hits the corresponding rules, which belongs to medium risk and needs to be paid attention to by staff.
[0048] Low level: The organization recommendation has 1-4 people, and hits the corresponding rules, which belongs to low risk and needs to be paid attention to.
[0049] The iterative module receives the recommended results and decision reasons, and continuously adjusts the prompt word design through user evaluation (evaluation of recommended results), for example, the clarity of the recommended quality adjustment prompt word in the recommended results or the context information is adjusted each time, and the large model output is gradually optimized. The processing steps are: recording the large model prompt word and the recommended results generated by each running and the user evaluation; using the large model to sort the effect of the large model prompt word and the recommended results and the user evaluation in descending order and scoring, generating a knowledge base; extracting the first prompt word of the event, region and organization in the knowledge base, which is used for Figure 3 the large model link.
[0050] In a second aspect, the embodiments of the present application provide a large model-based Internet situation awareness method, which comprises: Obtaining user portrait and user behavior data from received raw data, detecting the user portrait and the user behavior data according to a default threshold; generating event early warning information, regional early warning information and organizational early warning information according to three types of rules of event early warning rules, regional early warning rules and organizational early warning rules; inputting the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness; Obtaining a recommendation result and a decision reason output by the large model; the recommendation result includes a risk level, an attention object and an action suggestion, and the decision reason includes a reason formed by explaining the recommendation result in natural language; assembling the recommendation result and the decision reason according to different business scenarios; Recording the input of the large model, the recommendation result and user evaluation, and descendingly scoring the input of the large model according to the recommendation result and the user evaluation; extracting prompt words with the highest scores in events, regions and organizations, which are used to optimize a prompt word library of the large model. In a possible implementation, the inputting the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness includes: Based on the event early warning information, the regional early warning information and the organizational early warning information, obtaining an interaction path description and a rule; the interaction path description is a specific behavior sequence of a prewarning object, and the rule is a default configuration and a prewarning rule for triggering current prewarning information; According to the prompt word library, converting the interaction path description and the rule into a natural language form, and inputting the interaction path description and the rule into the large model in the form of text features.
[0051] In a possible implementation, the assembling the recommendation result and the decision reason according to different business scenarios includes: For an internal threat monitoring scenario, assembling personnel information, a department to which the personnel belong and a behavior sequence in the recommendation result and the decision reason; For a network attack monitoring scenario, assembling an attack source address, an attack type and an affected asset in the recommendation result and the decision reason; For a regional security monitoring scenario, assembling a risk region in the recommendation result and the decision reason.
[0052] In a possible implementation, the method further includes: When the attention object is an organization, if the risk level is a high level, the action suggestion is to solve immediately; if the risk level is a medium level, the action suggestion is to send staff to focus on; and if the risk level is a low level, the action suggestion is to continue to pay attention.
[0053] In a third aspect, the present application provides a computer readable storage medium, wherein a computer program is stored in the computer readable storage medium, and the computer program is executed by a processor to implement any of the above-mentioned methods for internet situation awareness based on a large model.
[0054] In the above embodiments, the implementation can be wholly or partially achieved by software, hardware, firmware, or any combination thereof. When implemented by software, the implementation can be wholly or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed by a computer, the computer instructions wholly or partially generate the processes or functions described in the embodiments of the present application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center through a wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available medium can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, Solid State Disk (SSD)), etc.
[0055] It should be noted that, in this document, the terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.
[0056] The various embodiments in the specification are described in a related manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the method embodiments, since they are basically similar to the system embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the system embodiment.
[0057] Although the embodiments of the present application have been shown and described above, it should be understood by those skilled in the art that the above embodiments are exemplary and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments without departing from the principles and spirits of the present application within the scope of the present application.
Claims
1. A large model-based internet situational awareness system, characterized in that, The system comprises: The construction module is used for obtaining user portraits and user behavior data from received raw data, detecting the user portraits and the user behavior data according to a default threshold, generating event early warning information, regional early warning information and organizational early warning information according to three types of rules, namely, event early warning rules, regional early warning rules and organizational early warning rules, and inputting the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness; The recommendation module is used for obtaining a recommendation result and a decision reason output by the large model, wherein the recommendation result comprises a risk level, an attention object and an action suggestion, and the decision reason comprises a reason formed by explaining the recommendation result in natural language, and the recommendation result and the decision reason are assembled according to different business scenarios; The iteration module is used for recording input of the large model, the recommendation result and user evaluation, performing descending order scoring on the input of the large model according to the recommendation result and the user evaluation, and extracting prompt words with the highest scores in events, regions and organizations for optimizing a prompt word library of the large model.
2. The system of claim 1, wherein, The situation awareness of the event early warning information, the regional early warning information and the organizational early warning information input into the large model comprises: Based on the event early warning information, the regional early warning information and the organizational early warning information, an interaction path description and a rule are obtained; the interaction path description is a specific behavior sequence of a prewarning object, and the rule is a default configuration and a prewarning rule for triggering current prewarning information; According to the prompt word library, the interaction path description and the rule are converted into a natural language form, and are input into the large model in the form of text features.
3. The system of claim 1, wherein, The assembly of the recommendation result and the decision reason according to different business scenarios comprises: For an internal threat monitoring scenario, personnel information, a department to which the personnel belong and a behavior sequence in the recommendation result and the decision reason are assembled; For a network attack monitoring scenario, an attack source address, an attack type and an affected asset in the recommendation result and the decision reason are assembled; For a regional security monitoring scenario, a risk region in the recommendation result and the decision reason is assembled.
4. The system of claim 1, wherein, When the attention object is an organization, if the risk level is a high level, the action suggestion is to solve immediately; if the risk level is a medium level, the action suggestion is to send staff to pay attention to; and if the risk level is a low level, the action suggestion is to pay attention continuously.
5. The system of claim 1, wherein, The large model is fine-tuned through the following steps: Historical user portraits and historical user behavior data are extracted from a situation awareness system database, historical interaction path descriptions and historical rules are obtained based on the historical user portraits and the historical user behavior data, and the historical interaction path descriptions and the historical rules are converted into text features in a natural language form; A basic large model is trained using the text features, and large model parameters are adjusted so that the large model outputs consistent with expected recommendation results and decision reasons.
6. A large model-based Internet situation awareness method, characterized in that, The method comprises: Obtaining user portrait and user behavior data from received raw data, detecting the user portrait and the user behavior data according to a default threshold; generating event early warning information, regional early warning information and organizational early warning information according to three types of rules of event early warning rules, regional early warning rules and organizational early warning rules; inputting the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness; Obtaining a recommendation result and a decision reason output by the large model; the recommendation result includes a risk level, an object of attention and an action suggestion, and the decision reason includes a reason formed by explaining the recommendation result in natural language; assembling the recommendation result and the decision reason according to different business scenarios; Recording the input of the large model, the recommendation result and user evaluation, and performing descending order scoring on the input of the large model according to the recommendation result and the user evaluation; extracting the highest scoring prompt words in events, regions and organizations for optimizing the prompt word library of the large model.
7. The method of claim 6, wherein, The inputting the event early warning information, the regional early warning information and the organizational early warning information into a large model for situation awareness comprises: Based on the event early warning information, the regional early warning information and the organizational early warning information, obtaining an interaction path description and a rule; the interaction path description is a specific behavior sequence of a pre-warning object, and the rule is a default configuration and a pre-warning rule for triggering the current pre-warning information; According to the prompt word library, the interaction path description and the rule are converted into natural language form, and input into the large model in the form of text features.
8. The method of claim 6, wherein, The assembling the recommendation result and the decision reason according to different business scenarios comprises: For an internal threat monitoring scenario, assembling personnel information, a department to which the personnel belong and a behavior sequence in the recommendation result and the decision reason; For a network attack monitoring scenario, assembling an attack source address, an attack type and an affected asset in the recommendation result and the decision reason; For a regional security monitoring scenario, assembling a risk region in the recommendation result and the decision reason.
9. The method of claim 6, wherein, The method further comprises: When the object of attention is an organization, if the risk level is a high level, the action suggestion is to solve immediately; if the risk level is a medium level, the action suggestion is to send staff to pay attention; and if the risk level is a low level, the action suggestion is to continue to pay attention.
10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement any one of the above large model-based internet situation awareness methods.