Network defense agent system based on large language model

Abstract

The invention belongs to the field of network security, and particularly discloses a network defense agent system based on a large language model. Through the design of the sensing layer, the decision analysis layer and the action execution layer, comprehensive protection of network threats is realized. The sensing layer is responsible for collecting original information from multiple channels and converting the original information into standardized data; the decision analysis layer performs modeling and threat reasoning on attack behaviors, evaluates a risk level and predicts subsequent actions; and the action execution layer specifically executes defense operation according to the defense strategy scheme output by the decision analysis layer. In addition, the application also constructs a data set oriented to attack and defense confrontation, records a complete attack sequence, defense response and effect evaluation thereof, and provides a reliable basis for continuous learning of defense agents. Experimental results show that the framework provided by the invention is superior to the traditional method in the aspects of attack detection accuracy, attack chain identification and defense strategy generation, and has stronger adaptability and real-time response capability.

Claims

1. A large language model-based network defense agent system, characterized in that, The application relates to a network security defense system based on a large language model. The perception layer is responsible for collecting original security data from a heterogeneous network environment, converting multi-source heterogeneous security data into a unified format of a security event set through semantic unified modeling, organizing the security event set into an event chain according to the time and logical order of attack behaviors, and delivering the security event set and the event chain to the decision analysis layer. The decision analysis layer is responsible for receiving the security event set and the event chain delivered by the perception layer, cleaning redundant events, correlating similar events and extracting core features of the events based on a large language model, and mapping the events to technical labels of an MITRE ATT&CK framework; attack behavior modeling is carried out on the event chain based on the MITRE ATT&CK framework, the tactical stage of an attacker is identified, a dynamic attack graph is constructed to predict a path, network security knowledge base knowledge is retrieved by combining RAG technology, a defense strategy scheme is generated by guiding threat reasoning through a special prompt word template and is delivered to the action execution layer, defense strategy execution results fed back by the action execution layer are received, the success rate of execution is analyzed, the defense effect and deviation and reasons are evaluated, the results are stored in a drill report and a knowledge base, and the results are used as incremental data to optimize the reasoning logic of the large language model and improve the accuracy of strategy generation. The action execution layer is responsible for receiving the defense strategy scheme delivered by the decision analysis layer, completing format verification, structured conversion and conflict detection, generating device executable instructions, calling defense measure execution instructions based on a standardized API interface system, and tracking execution status and effect in real time, and feeding back defense strategy execution results to the decision analysis layer. The perception layer comprises a multi-source data acquisition module, a feature extraction and abnormal behavior detection module and a data standardization processing module.

2. The cyber defense agent system of claim 1, wherein, The multi-source data acquisition module comprises a network traffic autonomous acquisition submodule, a Wazuh integrated acquisition submodule and a network threat detection submodule; the network traffic autonomous acquisition submodule is responsible for acquiring network original traffic data and delivering the network original traffic data to a feature extraction submodule; the Wazuh integrated acquisition submodule is responsible for acquiring terminal and application logs and terminal security event data through a distributed architecture and delivering the terminal and application logs and the terminal security event data to the feature extraction and abnormal behavior detection module; and the network threat detection submodule is responsible for acquiring network threat alarm data and delivering the network threat alarm data to an abnormal behavior detection submodule. ​ The feature extraction and abnormal behavior detection module comprises a feature extraction submodule and an abnormal behavior detection submodule; the feature extraction submodule is responsible for receiving network original traffic data and terminal and application log data, extracting quantitative traffic features by using a sliding window statistical method, constructing a process tree by using a process ID and a parent process ID, tracking a command execution chain and mapping to a MITRE ATT&CK framework, and generating structured terminal behavior features; the quantitative traffic features, the structured terminal behavior features and the mapped ATT&CK tactic label data are sent to the data standardization processing module; the abnormal behavior detection submodule is responsible for receiving Suricata alarm data fed back by the network threat detection submodule, terminal security event data fed back by the Wazuh integrated collection submodule, network traffic anomaly data generated by the network traffic autonomous collection submodule through traffic feature analysis, and real-time matching of events based on YAML rules through a rule engine, triggering a response action and generating an alarm, sending an alarm list and an abnormality mark to the data standardization processing module; The data standardization processing module is responsible for receiving quantitative traffic features, structured terminal behavior features and ATT&CK tactic label data, an alarm list and an abnormality mark, constructing a unified event timeline for the received data, establishing an inter-event association relationship based on common attributes, and generating a standardized event object comprising core fields through JSON formatting processing, and passing the unified format standardized event object set and an event chain organized according to the time and logical order of attack behaviors to the decision analysis layer.

3. The cyber defense agent system of claim 2, wherein, The feature extraction by using the sliding window statistical method specifically comprises: initializing an empty time window; for each new data packet in the data stream, adding the data packet to the window; when the window reaches a preset size, calculating statistical features; The statistical features comprise byte entropy and a packet length coefficient of variation, the byte entropy is used to quantify the randomness and irregularity of byte distribution in network traffic, and the packet length coefficient of variation is used to measure the dispersion degree of network data packet lengths in the window; The entropy value formula H = -∑p(x)log2p(x) is used The byte entropy is calculated, The probability of the occurrence of the byte in the current sliding time window is represented; The probability of the occurrence of the byte in the current sliding time window is represented; by the ratio of the standard deviation to the mean = 1.0 the coefficient of variation of the packet length is calculated, denotes the standard deviation of all packet lengths in the window, denotes the mean of all packet lengths in the window.

4. The cyber defense agent system of claim 1, wherein, The decision analysis layer comprises a data preprocessing module, an attack behavior modeling module and a threat reasoning and defense decision module; The data preprocessing module comprises a structured feature processing submodule and an event text description submodule; the structured feature processing submodule is responsible for receiving standardized event objects output by the perception layer, extracting structured features of attack behaviors, and outputting to the attack behavior modeling module; the event text description submodule is responsible for receiving fields in the standardized event objects output by the perception layer and associated event chain information, generating contextualized event text data by using a large language model semantic analysis, attack scene contextualization and text structuring technology, and outputting to the attack behavior modeling module and the threat reasoning and defense decision module, respectively; The attack behavior modeling module comprises a tactical phase identification submodule, an attack graph construction submodule, an attacker model library construction submodule and a data fusion submodule; wherein the tactical phase identification submodule is responsible for receiving the structured attack feature data and the contextualized event text data of the data preprocessing module, performing tactical phase matching through semantic matching of a large language model in combination with a MITRE ATT&CK framework label mapping probability model, and calculating a tactical phase probability; the attack graph construction submodule is responsible for obtaining a dynamic attack graph by introducing a time-sensitive prior probability updating mechanism into an improved Bayesian-Markov hybrid model in combination with Markov process modeling of attack state transitions according to the tactical phase probability, asset topology information and vulnerability data provided by the perception layer multi-source data acquisition module; the attacker model library construction submodule is responsible for obtaining attacker group characteristics by determining an optimal clustering number through a profile coefficient in combination with an improved hierarchical clustering algorithm according to historical attack and defense confrontation data, constructing a tactical transition probability matrix through maximum likelihood estimation and a Bayesian network, and obtaining an attacker model library by analyzing adaptive responses of attackers to defense measures; and the data fusion submodule is responsible for fusion processing of the tactical phase probability of the tactical phase identification submodule, the dynamic attack graph of the attack graph construction submodule and the attacker model library of the attacker model library construction submodule, and obtaining a structured attack behavior model by integrating the tactics, paths and attacker characteristics of attack behaviors through a large language model. The threat reasoning and defense decision module comprises a threat reasoning submodule and a defense decision submodule; wherein the threat reasoning submodule is responsible for obtaining a threat assessment report by implementing iteration of reasoning-retrieval-enhancement-reasoning again through an improved chain reasoning method in combination with retrieval enhancement generation technology according to the structured attack behavior model output by the attack behavior modeling module, the contextualized event text data output by the data preprocessing module and a network security knowledge base based on the MITRE ATT&CK framework; and the defense decision submodule is responsible for analyzing the deviation and reasons of the execution effect from the expectation according to the threat assessment report output by the threat reasoning submodule, the attacker model library output by the attacker model library construction submodule, current network environment state data and defense strategy execution results fed back by the action execution layer; then, the analysis conclusion is integrated into an incomplete information dynamic game model and a Markov decision process technology to optimize attacker behavior prediction and adjust strategy priority to screen an optimal defense strategy; finally, a defense strategy scheme and a decision explanation are output, and related conclusions are stored in a knowledge base and used for fine-tuning of a large language model to provide optimization basis for subsequent decision-making.

5. The cyber defense agent system of claim 4, wherein, The attack graph construction submodule realizes its functions in the following ways: (1) Defining core elements based on multi-source data, initializing attack graph nodes and edges: first, collecting asset topology information output by the perception layer, known vulnerability data, and current tactical phase probability output by the tactical phase identification submodule; then, taking asset value or attack state as a node, and taking the "pre-attack state→post-attack state" potential attack transition path as an edge, the weight of the edge is initialized as the product of the current tactical phase probability and the vulnerability score; the asset value is obtained by multidimensional quantitative and standardized processing of the "asset topology information" of the perception layer, and the vulnerability score is obtained by fusion and optimization processing of the "vulnerability data" of the perception layer; (2) Updating the edge weight of the attack graph based on the improved Bayesian-Markov hybrid model: applying the improved Bayesian method, introducing a time-sensitive prior probability updating mechanism, dynamically adjusting the edge weight, i.e., the attack path probability; (3) Path likelihood calculation and dynamic attack graph output: First, based on the updated edge weights, the likelihood of each attack path is calculated ; Subsequently, the paths of are eliminated, and the dynamic attack graph is output in the form of a directed graph, with each node, edge and corresponding being labeled, while predicting the most likely subsequent path of the attacker.

6. The cyber defense agent system of claim 5, wherein, The attack graph construction submodule updates the edge weight of the attack graph based on the improved Bayesian-Markov hybrid model in the following way: An incomplete information dynamic game model combined with Markov decision process is adopted to construct the attacker type space , which represents the attacker classification of different technical features and target features, where N is the total number of attacker types. For each type , based on the historical behavior data of attackers of this type in the CGD dataset, including attack sequences, tactical phase transfer records, defense response interaction records, train its state transition model , wherein, represents the network state at the moment, determined jointly by the asset topology information provided by the perception layer multi-source data acquisition module and the known vulnerability data, the asset topology information includes IP topology and asset importance rating, and the vulnerability data includes CVSS score and exploit difficulty, represents the action taken by the attacker at the moment; The defense decision process is built on a Bayesian updating mechanism, which continuously adjusts the belief distribution over the attacker types , The probability of judging the attacker as type at time is initialized to , which ensures a uniform initial belief distribution for optimal decision making. The update formula is , where is the conditional probability of an action taken by an attacker of type in state , which is derived from the attacker model library's statistical data and computed using maximum likelihood estimation. Non-zero probabilities are assigned to unobserved transitions using Laplace smoothing techniques. is the sum of the probabilities over all attacker types , which ensures that the updated belief distribution sums to 1. Based on the above model and belief update, the minimum maximum regret algorithm is used to calculate the optimal defense strategy : First, construct the loss function , quantify the loss of the defender when taking the strategy to face the action of the attacker, which is defined based on the defense effect evaluation index in the CGD dataset; Then traverse all the selected defense strategy set D and the attacker type space , select the defense strategy with "minimum loss under the worst attack scenario" through formula , to ensure the robustness of the defense decision By combining asset topology information, known vulnerability data and historical attack patterns, the likelihood of each path is calculated where, is the conditional probability of the attacker choosing a certain tactic under the current network state, which is derived from the time-sensitive update results of the improved Bayesian method; represents the asset value obtained after multi-dimensional quantification and standardization processing of the perception layer "asset topology information", represents the vulnerability score obtained after fusion optimization processing of the perception layer "vulnerability data".

7. The cyber defense agent system of claim 4, wherein, The attacker model library construction submodule realizes its function in the following way: First, an improved hierarchical clustering algorithm is used to identify attacker group characteristics from historical attack samples, convert each attack sequence into a feature vector, measure the similarity between attack samples using Euclidean distance, and perform clustering and merging using the Ward minimum variance method; Secondly, based on the identified attacker groups, a maximum likelihood estimation method is used to construct the tactical transition probability matrix. For each attacker group, the transition frequency between different tactical stages is counted, and the state transition probability is calculated by the formula wherein, represents the probability of an attacker group transitioning from "tactical stage " to "tactical stage ", with a value range of [0, 1]; represents the effective frequency of an attacker group successfully transitioning from "tactical stage " to "tactical stage " in historical attack and defense data; represents the total frequency of an attacker group being in "tactical stage " in the same historical attack and defense data, i.e., the total number of records with as the current stage in all attack records of the group, including transitions from to all possible subsequent stages. Finally, the adaptability of the attacker to the defense measures is analyzed using a Bayesian network, a conditional probability table is constructed, and the probability distribution of the attacker adopting different evasion strategies after the deployment of a specific defense measure is calculated.

8. The cyber defense agent system of claim 4, wherein, The threat reasoning submodule realizes its function in the following way: First, based on the standardized data output by the perception layer, including structured features and contextual event text, the pre-processing and semantic alignment of the reasoning input are completed: the standardized event objects delivered by the perception layer include event unique identifier, timing information, attack source and target, statistical features, and event natural language description, redundant fields are removed through data cleaning, and raw_description is converted into a semantic vector using a pre-trained text encoder, while structured features are mapped into standardized reasoning features, ensuring that the input data has both semantic information and quantitative features; Both of them together constitute a unified input feature set, ensuring that the input data has both semantic information and quantitative features, providing "semantic + quantitative" dual-dimensional support for subsequent large language model reasoning, adapting to the improved Qwen-7B model input format, and avoiding reasoning bias caused by single feature type; Secondly, an improved chain reasoning method is adopted to design a three-step reasoning process of "tactical confirmation → path prediction → risk assessment", guiding the model to gradually refine the reasoning: in the first step, based on the MITRE ATT&CK framework, the large language model analyzes the event characteristics and semantic vectors, combines the standardized reasoning features, calculates the matching probability of each tactical stage, and determines the current tactical stage of the attacker; in the second step, the attacker model library outputs the tactical transfer probability matrix and the dynamic attack graph path possibility to predict the possible attack path of the attacker; in the third step, based on the predicted path and asset importance rating, combined with the vulnerability CVSS score, the risk level is calculated, which will be integrated into the threat assessment report; Finally, the retrieval enhancement generation technology is introduced to build a knowledge enhancement reasoning mechanism: first, a network security knowledge base based on MITRE ATT&CK and D3FEND framework is constructed, integrating attack technology description, defense measures, and vulnerability exploitation rules, and using FAISS-IVF256 vector index technology to build an efficient retrieval system; in each step of reasoning, the current reasoning scenario is encoded as a query vector, and Top-5 related knowledge fragments are retrieved from the knowledge base through approximate nearest neighbor search; Then the retrieved knowledge fragments are integrated into structured context and input into the improved Qwen-7B model for reasoning enhancement; finally, the threat assessment report containing attack intent, predicted attack path, threat level, and reasoning basis is output, providing the core input for the defense decision-making submodule, where the attack intent is derived from the association analysis of tactical stage and predicted path and the ATT&CK tactic-intent mapping knowledge retrieved by RAG; the threat level is based on the risk level calculated in the third step, integrating attack chain complexity, threat weight in attacker model library, and real-time defense state feedback to determine.

9. The cyber defense agent system of claim 4, wherein, The defense decision-making submodule realizes its function in the following way: First, an attack-defense sequential decision-making framework is constructed by combining an incomplete information dynamic game model with a Markov decision process: based on the attacker type space output by the attacker model library. and each type of state transition model , for Real-time network status, which integrates asset topology and vulnerability distribution from the current network environment status data. To assess attacker behavior, the system quantifies the behavioral preferences of different attackers under specific states; simultaneously, it adjusts the distribution of beliefs about attacker types in real time using a Bayesian update mechanism. The updated formula is as follows ,in, Type attacker in state Take action The conditional probability, for At all times, the attacker type The initial belief is used to dynamically modify the attacker type judgment, providing a basis for targeted decision-making; Secondly, based on the game model and threat assessment results, the minimax regret algorithm is applied to calculate the optimal defense strategy: to minimize the maximum defense loss as the goal, the optimal strategy is screened from the set of all optional defense strategies D , the formula is , where A is the set of actions that the attacker may take, is the loss function, and the calculation method is is the defense strategy , the effectiveness score of the attack action , taken from the MITRE D3FEND framework, is the defense strategy implementation cost, is the cost weight coefficient; at the same time, combined with the predicted attack path possibility output by the threat reasoning submodule and the asset value, the defense strategy is preferentially deployed to the high-risk path and core asset, ensuring efficient allocation of resources; Finally, the knowledge enhancement generation and strategy feasibility checking mechanism is introduced to ensure that the defense strategy is executable and conflict-free: based on the fine-tuned Qwen-7B model and RAG technology, the MITRE D3FEND framework and industry best practice knowledge are retrieved to generate hierarchical defense strategies: immediate strategy, medium-term strategy, and long-term strategy; at the same time, the rule engine detects strategy conflicts, sorts the strategy implementation time window and execution priority, and finally outputs the defense strategy scheme and decision explanation, providing clear instructions for the action execution layer.

10. The cyber defense agent system of claim 1, wherein, The action execution layer is divided into two layers; The first layer is responsible for receiving the defense strategy scheme and decision explanation delivered by the decision analysis layer, performing format verification and structural conversion on the defense strategy scheme, generating a standardized strategy structure, and assisting in strategy analysis combined with the decision explanation. After the strategy analyzer classifies the strategy fragments, a template is selected for each strategy fragment, and a device-recognizable intermediate rule is generated through a rule engine. The rule is then translated into a specific device execution command, which is scheduled and executed concurrently by a thread pool dispatcher. The API calling executor calls the API interface of the corresponding defense category, passes the instruction and execution parameters to the second layer, and tracks and analyzes the execution results to determine whether the defense action is successful and achieves the expected defense effect. The execution results are encapsulated and fed back to the decision analysis layer in the form of a structured execution report, forming a closed loop of "strategy receiving-analysis-execution-feedback"; The second layer includes a border protection module, an intrusion detection and defense module, an access control and authentication module, a protocol security and encrypted communication module, a terminal protection module, and a behavior monitoring and auditing module. Among them, The border protection module is responsible for receiving the API calling instructions and execution parameters of the border protection class delivered by the first layer, performing malicious traffic interception and key service protection, dynamically generating targeted rules to limit reconnaissance behavior, configuring protection rules to identify and intercept application layer attacks, generating WAF strategy configuration commands, and returning the rule execution status and intercepted traffic statistics to the first layer in real time to support result analysis and feedback to the decision analysis layer. The intrusion detection and defense module is responsible for receiving the API calling instructions and execution parameters of the intrusion detection and defense class delivered by the first layer, continuously monitoring network traffic and system behavior to identify and respond to intrusion activities, generating IDS / IPS rules to identify known attacks based on the latest attack signatures, establishing network and system baseline behavior models, calling zeek scripts to detect abnormal behavior and protect against zero-day attacks, and returning the detected attack events, alarm information, and disposal results to the first layer to form a closed loop feedback. The access control and authentication module is responsible for receiving the API calling instructions and execution parameters of the access control and authentication reinforcement class delivered by the first layer, ensuring that only authorized users can access protected resources and improving authentication security by generating and managing access control list rules to limit access to critical systems and implementing fine-grained access control, and performing authentication enhancement operations to reduce the risk of credential leakage, and returning the access control rule effectiveness status and authentication event logs to the first layer. The protocol security and encrypted communication module is responsible for receiving the API calling instructions and execution parameters of the protocol security and encrypted communication class delivered by the first layer to ensure the security of data transmission: eliminating known protocol vulnerabilities, establishing a secure data transmission channel, and using strong encryption algorithms for remote access. The protocol configuration results and encrypted channel establishment status are returned to the first layer. The terminal protection module is responsible for receiving terminal protection API call instructions and execution parameters delivered by the first layer, protecting the terminal device from malicious attacks and unauthorized operations, performing terminal hardening operations, scheduling malware scanning and isolation, managing malware white lists, preventing malware from spreading on the terminal, and returning terminal configuration states and malware disposal results to the first layer. The behavior monitoring and auditing module is responsible for receiving behavior monitoring and auditing API call instructions and execution parameters delivered by the first layer, implementing full-process monitoring and auditing of system behavior: collecting logs, configuring alarm triggering conditions, generating audit reports, recording various types of key events, forming a complete audit trail, providing a basis for post-tracing and defense strategy optimization, and returning log collection states and audit report generation results to the first layer, and finally feeding back to the decision analysis layer.

Images