Network security situation awareness method based on fusion of generative adversarial network and AI large model

Abstract

The invention relates to a network security situation awareness method based on fusion of a generative adversarial network and an AI large model. The method comprises the following steps: based on an asset database, adding a service context in a real-time event to obtain a standard real-time event; the service context comprises at least one of the importance level of the access assets and a service system to which the access assets belong; inputting each standard real-time event into a threat evaluation model to obtain a threat confidence score corresponding to the single real-time event; the threat confidence score represents the possibility that the real-time event is a real threat; based on the threat confidence score, performing association analysis on the real-time event to obtain a global network security situation map; the global network security situation map is used for representing risk conditions faced by the whole network environment. By adopting the method, high-risk threats can be effectively captured, risk analysis is carried out in cooperation with multiple events, and the overall situation sensing capability of network security is improved.

Description

Technical Field

[0001] This invention belongs to the field of cybersecurity, and in particular relates to a cybersecurity situational awareness method based on the fusion of generative adversarial networks and large AI models. Background Technology

[0002] With the rapid development of cybersecurity threat situational awareness technology, security event correlation and assessment methods based on big data analytics are gradually becoming mainstream. This technology can automate the processing of massive amounts of security logs, identifying potential attack clues through correlation rules and statistical models, effectively improving the efficiency of threat discovery. Traditional technologies typically use fixed rules and feature matching. Security teams predefine a series of attack characteristics or abnormal behavior patterns, and the system filters security events by matching these predefined rules. Then, analysts rely on their experience to manually assess and prioritize alerts. Current methods have significant problems. On the one hand, rigid rules are difficult to adapt to new and unknown threats, leading to lagging detection capabilities. On the other hand, the massive volume of alerts causes severe information overload for security personnel, with many false positives and low-value alerts masking truly high-risk situations. Summary of the Invention

[0003] Therefore, it is necessary to provide a network security situational awareness method based on the fusion of generative adversarial networks and large AI models that can effectively adapt to new threats and capture high-risk threats in real time, in order to address the above-mentioned technical problems.

[0004] Firstly, this application provides a network security situational awareness method based on the fusion of generative adversarial networks and large AI models, including:

[0005] Based on the asset database, a business context is added to a real-time event to obtain a standard real-time event; the business context includes the importance level of the accessed asset and at least one of the business systems to which the accessed asset belongs.

[0006] Each standard real-time event is input into the threat assessment model to obtain the threat confidence score for the corresponding individual real-time event; the threat confidence score represents the probability that the real-time event is a real threat.

[0007] Based on threat confidence scores, real-time events are correlated and analyzed to obtain a global network security situation map; the global network security situation map is used to characterize the risk status faced by the entire network environment.

[0008] Furthermore, the threat assessment model was obtained through the following methods:

[0009] Random noise is input into the generator of the adversarial network to generate a set of simulated threat events;

[0010] Event samples in the simulated threat event set are labeled as threats and merged with the basic training dataset to obtain the enhanced training dataset;

[0011] The threat assessment model is obtained by using an enhanced training dataset as the training set and performing supervised fine-tuning on a large language model. The input of the threat assessment model is the features and context of the threat event sample, and the output is the confidence probability that the threat event sample is a real threat.

[0012] Furthermore, the generator is trained using the following method:

[0013] The threat event samples are obtained by filtering out event samples classified as real threats from the basic training dataset;

[0014] A batch of threat event samples is mixed with the initial generated samples generated by the generator to obtain a mixed sample; the mixed sample is then input into the discriminator of the adversarial network to obtain the discrimination result.

[0015] Based on the discrimination results, the loss function of the discriminator is calculated; and based on the loss function, the neural network weights of the discriminator are updated to obtain the updated discriminator.

[0016] The newly generated samples, based on the new random noise, are input into the updated discriminator to obtain a new discrimination result; the loss value of the generator is calculated based on the new discrimination result.

[0017] With the discriminator parameters fixed, the neural network weights of the generator are updated to obtain the updated generator. When the updated generator and the updated discriminator meet the preset iteration stopping condition, the iteration is stopped, and the generator is obtained.

[0018] Furthermore, using the enhanced training dataset as the training set, supervised fine-tuning is performed on a large language model to obtain a threat assessment model, including:

[0019] Mini-batch samples are extracted from the augmented training dataset, and the mini-batch samples are preprocessed to obtain mini-batch training data.

[0020] A small batch of training data is input into a large language model to obtain the prediction result for each input sample; the prediction result is then compared with the true label, and the loss value is obtained using the following formula:

[0021]

[0022] Where L is the loss value, N is the batch size, and i is the sample index. Let i be the true label of the i-th sample. Let be the predicted probability of the model for the i-th sample;

[0023] The parameters of the large language model are updated based on the loss value to obtain the updated large language model;

[0024] The updated large language model was evaluated using a validation dataset to obtain the performance evaluation results.

[0025] Large language models whose performance evaluation results meet the preset training termination conditions are identified as threat assessment models.

[0026] Furthermore, based on threat confidence scores, real-time events are correlated and analyzed to obtain a global cybersecurity situation map, including:

[0027] Real-time events with threat confidence scores not greater than a preset threshold are removed to obtain a list of high-threat events.

[0028] Extract features from real-time events in the high-threat event list; and based on a clustering algorithm, cluster real-time events with common features to obtain attack activity clusters;

[0029] If the real-time events in the attack activity cluster conform to the preset attack flow, the attack stage corresponding to the real-time event is inferred, and the attack sequence is obtained.

[0030] Based on the network topology diagram, the potential business impact range of the attack sequence is calculated, and an attack analysis report is obtained.

[0031] Using the network topology map as a base map, an attack analysis report is overlaid to obtain a global network security situation map.

[0032] Furthermore, based on the network topology diagram, the potential business impact range of the attack sequence is calculated, resulting in an attack analysis report, including:

[0033] Analyze each attack sequence and extract the target asset information pointed to by all real-time events; the target asset information includes the asset name, ownership of the business system, and importance level;

[0034] Starting with the asset corresponding to the target asset information, analyze the network topology to find all other assets that can be accessed from the starting asset, and obtain the potential movement path map;

[0035] Based on the potential mobile path map, the impact of asset attacks on business systems is analyzed, and an impact chain analysis report is obtained.

[0036] Based on the importance level and impact chain analysis report, calculate the overall business risk value of the entire attack sequence;

[0037] Integrate overall business risk values, impact chain analysis reports, and asset information to generate an attack analysis report.

[0038] Furthermore, after performing correlation analysis on real-time events based on threat confidence scores to obtain a global cybersecurity situation map, the process also includes:

[0039] Based on the global network security situation map, the objectives of the response are identified and a list of objectives is obtained. Then, based on the list of objectives, the corresponding actions are matched in the response action knowledge base to obtain a list of candidate actions.

[0040] Based on the decision analysis model, each action in the candidate action list is evaluated from multiple dimensions to obtain a quantitative evaluation score; the evaluation dimensions include effectiveness, cost, execution speed and reversibility.

[0041] Based on the quantitative assessment score, and under the premise of meeting the preset constraints, a sequence of response actions is generated with the goal of maximizing the reduction of overall risk and minimizing the impact on business.

[0042] Based on the response action sequence, a handling recommendation is generated; the handling recommendation is used to assist in making safe operation decisions.

[0043] Secondly, this application also provides a network security situational awareness device based on the fusion of generative adversarial networks and large AI models, comprising:

[0044] The context module is used to add business context to real-time events based on the asset database to obtain standard real-time events. The business context includes the importance level of the accessed asset and at least one of the business systems to which the accessed asset belongs.

[0045] The scoring module is used to input each standard real-time event into the threat assessment model to obtain the threat confidence score for the corresponding single real-time event; the threat confidence score represents the probability that the real-time event is a real threat;

[0046] The analysis module is used to perform correlation analysis on real-time events based on threat confidence scores to obtain a global network security situation map; the global network security situation map is used to characterize the risk status faced by the entire network environment.

[0047] Thirdly, this application also provides a computer device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement any step of the method provided in the first aspect of this application.

[0048] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any step of the method provided in the first aspect of this application.

[0049] The aforementioned cybersecurity situational awareness method, based on the fusion of generative adversarial networks and AI large-scale models, uses an asset database to add business context to real-time events, resulting in standard real-time events. The business context includes the importance level of the accessed asset and at least one business system to which the accessed asset belongs. Each standard real-time event is input into a threat assessment model to obtain a threat confidence score for that individual event. The threat confidence score represents the probability that a real-time event is a real threat. Based on the threat confidence score, real-time events are correlated to obtain a global cybersecurity situational map. This global cybersecurity situational map represents the risk status faced by the entire network environment. By introducing business context and prioritizing business risks, the AI ​​large-scale model probabilizes the threat level of each event, replacing simple binary judgments. This effectively filters out massive amounts of low-value noise and false alarms, avoiding alarm fatigue. Furthermore, by correlating and clustering isolated high-confidence threat events to form a global cybersecurity situational map, the accuracy and relevance of global network situational awareness are improved. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a schematic diagram of the process of a network security situation awareness method based on the fusion of generative adversarial networks and large AI models, provided in an embodiment of the present invention.

[0052] Figure 2 This is a schematic diagram of the structure of a network security situation awareness device based on the fusion of generative adversarial networks and large AI models, provided in an embodiment of the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] In one embodiment, such as Figure 1 As shown, a network security situation awareness method based on the fusion of generative adversarial networks and large AI models is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, and to a system including both a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0055] Step 101: Based on the asset database, add business context to the real-time event to obtain a standard real-time event; the business context includes the importance level of the accessed asset and at least one of the business systems to which the accessed asset belongs.

[0056] Real-time events refer to security-related logs or alarms collected in real time from network devices, servers, or terminals. They possess technical attributes, including source IP (Internet Protocol Address), destination IP address, port number, operation time, and action. The asset database is a knowledge base storing information on all IT (Information Technology) assets in the network and their business attributes. It records the technical identity of assets, associates them with business context, and serves as the core bridge linking technical events with business impact. Business context refers to the information needed to understand an event from a business perspective. This mainly includes accessing the asset's importance level: the degree to which the asset is critical to the organization's business continuity (the severity of attacking a core database server is completely different from attacking a test server); and accessing the business system to which the asset belongs: the specific business unit or application system supported by the asset, which helps in understanding the potential business targets of the attack. Standard real-time events are new event objects formed by querying the asset database and incorporating business context information, based on real-time events. They contain both the original technical details and added business-dimensional attributes. When a new real-time event is generated, the terminal parses the key identifier in the event and uses the identifier as a query key to match and search in the asset database. If a corresponding asset record is found, the preset business context information in the asset record is extracted and appended as a new field to the original real-time event to generate a more comprehensive standard real-time event.

[0057] Step 102: Input each standard real-time event into the threat assessment model to obtain the threat confidence score for the corresponding single real-time event; the threat confidence score represents the probability that the real-time event is a real threat.

[0058] Specifically, the threat assessment model is a trained AI (Artificial Intelligence) model that acts as a virtual security expert, comprehensively assessing the malicious nature of an event based on its multi-dimensional characteristics. This model is the core technology. The threat confidence score is a numerical value, a probability value between 0 and 1, quantitatively representing the likelihood that the event is a real cyber threat. The endpoint takes standard real-time events as input and feeds them into the threat assessment model. Internally, the model performs complex, non-linear calculations and analyses on these features, outputting a result—the threat confidence score. This score is a probabilistic judgment based on experience learned from massive amounts of historical data.

[0059] Step 103: Based on the threat confidence score, perform correlation analysis on real-time events to obtain a global network security situation map; the global network security situation map is used to characterize the risk status faced by the entire network environment.

[0060] Specifically, correlation analysis is a data analysis technique that moves beyond viewing individual events in isolation. Instead, it correlates, groups, and infers multiple events according to certain logical rules to uncover deeper and more complex attack patterns. A global cybersecurity posture map is a comprehensive view designed to provide security operations personnel with an intuitive and complete snapshot of the overall risk situation. The map integrates and displays ongoing attack activities, the sources and targets of attacks, the evolution path of attacks, and the potential scope of impact on business systems. The endpoint uses a threat confidence score to set a threshold, filtering out a large number of low-scoring events and focusing on a list of high-threat events to reduce noise. Features are extracted from high-scoring events, and clustering algorithms are used to group events with common characteristics, suggesting these events may originate from the same attacker or the same attack campaign. Based on clustering, the temporal sequence and logical relationships of events within a cluster are analyzed. If a known attack flow is observed, the current stage of the attack is inferred, forming an attack sequence. Combining the network topology map and asset database, the scope of assets affected and potentially spreading by the attack sequence is analyzed, calculating its potential impact on business systems and overall risk value. Attack clusters, attack sequences, and the scope of impact are overlaid on the network topology map to generate a global network security situation map.

[0061] This embodiment provides a network security situation awareness method based on the fusion of generative adversarial networks and AI large-scale models. Based on an asset database, business context is added to real-time events to obtain standard real-time events. The business context includes the importance level of the accessed asset and at least one business system to which the accessed asset belongs. Each standard real-time event is input into a threat assessment model to obtain a threat confidence score for the corresponding individual real-time event. The threat confidence score represents the probability that the real-time event is a real threat. Based on the threat confidence score, the real-time events are correlated to obtain a global network security situation map. The global network security situation map is used to represent the risk status faced by the entire network environment. Through the above methods, business context is introduced into each real-time event. Based on the priority of business risks, the threat probability of each event is probabilistically evaluated using an AI large-scale model, replacing simple binary judgments. This effectively filters out massive amounts of low-value noise and false alarms, avoiding alarm fatigue. Isolated high-confidence threat events are correlated and clustered to form a global network security situation map, improving the accuracy and targeting of global network situation awareness.

[0062] In one embodiment, the threat assessment model is obtained through the following method:

[0063] Step 201: Standardize historical cybersecurity incidents to obtain standardized security incidents; and classify the standardized security incidents based on labels to obtain a basic training dataset; the labels include real threats and normal behaviors, which are used to characterize the threat of cybersecurity incidents.

[0064] Historical network security events refer to the collection of various security-related logs and alerts recorded in the past network. This data is raw and unprocessed, potentially inconsistent in format, and contains a large amount of irrelevant information. Standardization refers to the data preprocessing process, aiming to eliminate the heterogeneity of the raw data and make it conform to a unified format and standard. This includes standardizing time formats, representing IP addresses and port numbers, standardizing event type names, and encoding categorical variables. Standardized security events are historical events that have been cleaned and formatted. All events have the same field structure and data format, eliminating noise and inconsistencies in the raw data and providing clean and consistent input for model learning. Labels, also known as annotations or ground truths, are explicit classification answers assigned to each historical event. In this embodiment, it is a binary variable used to indicate whether an event is essentially a real threat or normal behavior. Labels are the target of model learning. The basic training dataset consists of a large number of standardized security events and their corresponding labels, containing questions and standard answers. The terminal standardizes the messy historical network security events, transforming them into standardized security events with a uniform format. Based on the tags carried in the historical network security events, each standardized event is grouped to determine whether it is a real threat or normal behavior. All these grouped events are aggregated to form the basic training dataset.

[0065] Step 202: Input random noise into the generator of the adversarial network to generate a set of simulated threat events.

[0066] Specifically, the generator in an adversarial network (ANN) is a component that, after training, learns the underlying statistical distributions and feature patterns inherent in threat event samples. Its function is to receive a random noise vector and output a completely new data sample that is highly similar to a real threat sample. The simulated threat event set is a collection of new event samples generated by the trained generator. These samples are not real events, but they are highly similar to real threats in terms of feature representation, enough to be indistinguishable from the real ones. The endpoint uses a generative model for data synthesis, inputting random noise into the pre-trained ANF generator. Based on the learned threat feature distributions, the generator generates a large number of new simulated threat events, all of which together constitute the simulated threat event set.

[0067] Step 203: Mark the event samples in the simulated threat event set as threats and merge them with the basic training dataset to obtain the enhanced training dataset.

[0068] Specifically, the enhanced training dataset is a dataset used to train the threat assessment model, and it is formed by merging the original base training dataset and the set of simulated threat events. The terminal takes all event samples from the set of simulated threat events, uniformly labels them with threats, and simply merges these labeled generated events with the original base training dataset to obtain a new, larger-scale enhanced training dataset.

[0069] Step 204: Use the enhanced training dataset as the training set and perform supervised fine-tuning on a large language model to obtain the threat assessment model. The input of the threat assessment model is the features and context of the threat event sample, and the output is the confidence probability that the threat event sample is a real threat.

[0070] The large language model is a deep learning model pre-trained on massive amounts of general text data, possessing powerful contextual understanding and pattern recognition capabilities. It has broad knowledge and strong learning abilities, but is not a cybersecurity expert. Supervised fine-tuning is a transfer learning technique that involves further training a pre-trained AI model using domain-specific labeled data, aiming to refine the model's general knowledge for specific tasks. The threat assessment model is a large language model that has undergone supervised fine-tuning, focusing on cybersecurity threat assessment. Its input is the characteristics and business context of an event, and its output is the confidence probability that the event is a real threat. The terminal uses the enhanced training dataset as training samples, inputting it into the large language model. The model makes predictions for each sample, compares the predictions with the true labels, calculates the loss, and updates the AI ​​model's parameters through backpropagation. This continuously improves the model's predictive ability towards accurately distinguishing threats from normal behavior. Once the model's performance meets the requirements, training stops, and the final model is the threat assessment model.

[0071] This embodiment significantly expands the training data for threat categories, effectively solving the problem of sample class imbalance caused by the scarcity of attack events. Furthermore, by introducing generated data, it increases the diversity of training data, which helps improve the model's generalization ability and robustness in detecting novel and unknown threats. It also obtains a high-performance, high-precision dedicated AI large-scale model evaluation engine, which combines the powerful abstract understanding capabilities of large-scale language models with specialized training on high-quality domain data. This engine can comprehensively consider event features and business context to output an accurate and quantifiable threat probability, providing core intelligent judgment for the entire situational awareness process.

[0072] In one embodiment, the generator is trained using the following method:

[0073] Step 301: Select event samples from the basic training dataset that are classified as real threats to obtain threat event samples.

[0074] Specifically, threat event samples are selected from the basic training dataset and labeled as real threats, making them rare and valuable. The endpoint extracts all real threat events from the basic training dataset to synthesize threat event samples.

[0075] Step 302: Mix a batch of threat event samples with the initial generated samples generated by the generator to obtain a mixed sample; and input the mixed sample into the discriminator of the adversarial network to obtain the discrimination result.

[0076] This step is the first iteration in a single iteration of the GAN (Generative Adversarial Network) training loop. Its purpose is to allow the discriminator to judge between real and generated data and obtain a judgment result. A batch of threat event samples is a small subset of real events labeled "threat" randomly selected from the training data; these are positive samples, representing the real data distribution the generator needs to learn. The initial generated samples are a batch of simulated event samples produced by the generator in its current state based on the input random noise vector; these are negative samples, reflecting the generator's current capabilities. The mixed samples are a new dataset formed by simply mixing the aforementioned batch of real and generated samples, allowing the discriminator to encounter both real and generated data simultaneously during training. The discriminator of the adversarial network is another core component of GAN, tasked with distinguishing whether the input data comes from the real data distribution or from the generator's generated data; essentially, it's a binary classification model. The judgment result is that after the mixed samples are input into the discriminator, the discriminator makes a judgment on each sample and outputs a probability value representing the likelihood that the sample is judged as real. The terminal allows the discriminator to make a round of judgments. It prepares a batch of real data and a batch of generated data of the same size generated by the generator, and merges them into a mixed sample. This mixed sample is then input into the discriminator one by one. The discriminator calculates for each sample based on its current internal parameters and outputs a score between 0 and 1, which is the discrimination result. This score represents the discriminator's confidence in each sample being true.

[0077] Step 303: Based on the discrimination results, calculate the loss function of the discriminator; and based on the loss function, update the neural network weights of the discriminator to obtain the updated discriminator.

[0078] Specifically, the discriminator's loss function is a mathematical function used to quantify the degree of error in the discriminator's judgments. It is calculated as follows: for real samples, the closer the probability value output by the discriminator is to 1, the smaller the loss; for generated samples, the closer the probability value output by the discriminator is to 0, the smaller the loss; conversely, a misjudgment increases the loss. The value of the loss function is a scalar representing the discriminator's current average level of error. The discriminator's neural network weights refer to the adjustable parameters within the discriminator model. These parameters determine how the discriminator calculates the output result from the input data. The process of training the model is essentially adjusting these parameters. The updated discriminator is a model with adjusted neural network weights. The goal of the adjustment is to minimize the loss function, enabling the discriminator to make more accurate judgments when faced with the same data in the future. The terminal optimizes the discriminator through backpropagation and gradient descent. It calculates the discriminator's loss function based on the judgment results and the real labels, calculates the gradient of the loss function with respect to all discriminator weights, and uses an optimization algorithm to slightly update the discriminator's neural network weights along the reverse direction of the gradient, resulting in an updated discriminator with slightly stronger discriminative ability.

[0079] Step 304: Input the newly generated samples generated by the generator based on the new random noise into the updated discriminator to obtain a new discrimination result; calculate the loss value of the generator based on the new discrimination result.

[0080] Specifically, the generator's loss is a mathematical function that quantifies the generator's failure to fake data. Since the generator's goal is to deceive the discriminator, the loss function is calculated in the opposite way to the discriminator's, aiming to make the discriminator's output probability of the generated samples as close to 1 as possible. The generator's loss encourages its output to cause the discriminator to misjudge. The new random noise is a new, randomly generated sequence of numbers, serving as the generator's input seed. Different random noises will cause the generator to produce different output samples. The newly generated samples are a batch of new simulated event samples generated by the generator based on the new random noise vector. The new discrimination result is obtained by inputting the newly generated samples into the updated discriminator, where this stronger discriminator judges these newly generated samples. Terminal testing of the generator's effectiveness against the new discriminator involves using a new set of random noise to generate a batch of new samples without mixing them with real data. These purely generated samples are then input into the updated discriminator, yielding a new discrimination result. This result represents how fake these newly generated samples are in the eyes of the new, stronger discriminator, providing a quantitative evaluation of the generator's performance.

[0081] Step 305: Fix the parameters of the discriminator, update the neural network weights of the generator to obtain the updated generator. When the updated generator and the updated discriminator meet the preset iteration stopping condition, stop the iteration and obtain the generator.

[0082] In this process, fixing the discriminator's parameters means temporarily keeping all the discriminator's weights unchanged during generator updates, without further calculation or updates, ensuring the generator is optimized against a fixed discriminator. The generator's neural network weights are adjustable parameters within the generator model that determine how samples are generated from noise vectors. The updated generator refers to the generator model with adjusted neural network weights, the goal of which is to minimize the generator's loss, i.e., to improve its ability to deceive the discriminator. The terminal optimizes the generator through backpropagation and gradient descent. Based on the new discrimination result, it calculates the generator's loss, fixes the discriminator's parameters, and calculates the gradient of the generator's loss with respect to the generator's neural network weights. This gradient indicates how the generator should adjust its weights to make its generated samples more likely to be misclassified as real by the discriminator. The generator's weights are then updated, resulting in the updated generator. The preset iteration stopping conditions are pre-defined criteria used to determine when training ends. Examples of common conditions include: reaching the maximum number of training rounds; the generator and discriminator reaching Nash equilibrium, meaning the discriminator can no longer effectively distinguish between real and generated samples, with its accuracy approaching 50%, similar to random guessing; and the quality of samples generated by the generator no longer showing significant improvement after multiple iterations. The generator is a trained AI model capable of generating sufficiently realistic simulated threat event samples from random noise. The terminal evaluates the training status and makes a decision. After completing one full iteration, it checks whether the updated generator and discriminator meet the preset iteration stopping conditions. If they do, training stops, and the current updated generator is used as the final generator output; otherwise, it returns to step 301 and begins a new round of adversarial training.

[0083] This embodiment trains an adversarial network to iteratively generate new generators and discriminators, improving the generator's ability to produce realistic samples, thereby enhancing the training realism of the threat assessment model and improving the accuracy of perceiving network security situation.

[0084] In one embodiment, an enhanced training dataset is used as the training set, and supervised fine-tuning is performed on a large language model to obtain a threat assessment model, including:

[0085] Step 401: Extract mini-batch samples from the enhanced training dataset and preprocess the mini-batch samples to obtain mini-batch training data.

[0086] The augmented training dataset is the final training dataset that combines real threat samples, normal behavior samples, and simulated threat samples generated by the generator. Mini-batch samples are a small subset of samples randomly selected from the augmented training dataset, containing 32, 64, or 256 event samples. Mini-batch processing, rather than processing all data at once, balances training efficiency and memory consumption; the introduced noise also helps the model generalize better. Preprocessing is the final transformation operation performed before inputting data into the model, aiming to make it fully conform to the model's input format and requirements. This includes converting text information into numeric identifiers that the model can understand, padding sequences of different lengths to a uniform length, and normalization. Mini-batch training data is a standardized batch of data obtained after preprocessing the mini-batch samples, which can be directly received and processed by a large language model. The terminal performs data sampling and format conversion. The training process does not use the entire large dataset at once, but rather iterates, randomly selecting a mini-batch of samples in each iteration. These samples are preprocessed, transforming them from the original data format into the tensor format expected by the model, resulting in a uniform batch of mini-batch training data.

[0087] Step 402: Input the mini-batch training data into the large language model to obtain the prediction result for each input sample; then compare the prediction result with the true label and obtain the loss value using the following formula:

[0088]

[0089] Where L is the loss value, N is the batch size, and i is the sample index. Let i be the true label of the i-th sample. Let be the predicted probability of the model for the i-th sample.

[0090] Specifically, a large language model is a pre-trained AI model with powerful fundamental capabilities, trained on massive amounts of general-purpose data. In this step, the current version of the model is used; it could be the initial version or a version updated in previous batches. The prediction result is the raw output of the large language model after inputting a small batch of training data, calculating for each sample. For binary classification tasks, this is the unnormalized score. The prediction probability is a probability value between 0 and 1, converted from the model's prediction by an activation function. This probability value represents the model's confidence that a sample belongs to a real threat. The true label is the pre-labeled true category of the i-th sample in the dataset, serving as the standard answer for judging the model's prediction accuracy. The loss value is a scalar value calculated using a given binary cross-entropy loss function. This function systematically compares the predicted probability and the true label for each sample and calculates an average error. The loss value quantitatively represents how poorly the model performs on this small batch of data; a larger loss value indicates a greater deviation between the model's prediction and reality. The terminal feeds the prepared small batch of training data into the model for forward propagation to obtain the predicted probability of each sample. Each predicted probability and its corresponding true answer are substituted into the loss function formula. The essence of the formula is: for real threats, the case with a low predicted probability is penalized; for normal behavior, the case with a high predicted probability is penalized. The loss of all samples is averaged to obtain the final loss value.

[0091] Step 403: Update the parameters of the large language model based on the loss value to obtain the updated large language model.

[0092] Specifically, a large language model is a large AI model. The parameters refer to the hundreds of millions of adjustable weights and biases within the model. These parameters determine how the model processes input data and obtains output. The essence of training the model is to find a set of optimal parameter values. An updated large language model refers to the version of the model whose internal parameters have been adjusted in this round. The terminal performs backpropagation and gradient descent to calculate the gradient of the loss value with respect to all model parameters. The gradient is a vector indicating whether each parameter needs to be increased or decreased, and by how much, to most effectively reduce the loss. Using optimization algorithms, the model parameters are updated in small increments along the opposite direction of the gradient.

[0093] Step 404: Use the validation dataset to evaluate the performance of the updated large language model and obtain the performance evaluation results.

[0094] The validation dataset is an independent dataset with real labels, separate from the training data. It is not used to directly update model parameters but rather to objectively evaluate the model's performance on unseen data. Performance evaluation results are one or more quantitative metrics calculated on the validation dataset to measure the model's true performance. Commonly used metrics include accuracy, precision, recall, F1 score, and AUC (Area Under Curve). These metrics reflect the model's practical value better than training loss. After completing a certain number of training rounds, the terminal runs the updated large language model on the complete validation dataset to obtain prediction results for all samples. Based on these prediction results and the real labels, various evaluation metrics are calculated to obtain the performance evaluation results.

[0095] Step 405: The large language model whose performance evaluation results meet the preset training termination conditions is identified as the threat assessment model.

[0096] The preset training termination conditions are pre-defined rules used to determine when training should end. Examples include: performance metrics on the validation set no longer improving after multiple consecutive iterations; the maximum number of training epochs has been reached; and the performance metrics have reached a satisfactory threshold. The threat assessment model is a large-scale language model that meets performance requirements and has undergone supervised fine-tuning, officially becoming a usable, dedicated AI model capable of outputting threat confidence for real-time events. The terminal compares the performance assessment results with the preset training termination conditions. If the conditions are met, the entire training cycle stops, and the updated large-scale language model is officially identified as the threat assessment model. If the conditions are not met, the process returns to step 401 to continue the next round of iterative training.

[0097] This embodiment trains a large language model and continuously updates the model's parameters to enable it to identify threats. It obtains an optimal, production-ready model at the appropriate time, ensuring that the training process is neither insufficient nor excessive, and ultimately delivers a high-performance, highly reliable, and specialized model.

[0098] In one embodiment, based on threat confidence scores, real-time events are correlated to obtain a global network security situation map, including:

[0099] Step 501: Remove real-time events with threat confidence scores not greater than a preset threshold to obtain a list of high-threat events.

[0100] The threat confidence score is a probability value output by the threat assessment model for each standard real-time event, representing the likelihood that the event is a real threat. The preset threshold is a critical value pre-set based on business risk tolerance; it's a key risk adjustment lever. A lower threshold makes the system more sensitive, resulting in more alerts; a higher threshold makes the system more conservative, focusing only on high-certainty threats. The high-threat event list is a filtered set of events containing real-time events with threat confidence scores higher than the preset threshold, representing the most likely and priority security alerts. The endpoint iterates through the threat confidence scores of all real-time events, comparing each score to the preset threshold. Only events with scores greater than the threshold are retained and added to a new list, the high-threat event list. Events with scores below the threshold are temporarily ignored or archived for later auditing.

[0101] Step 502: Extract the features of real-time events from the list of high-threat events; and based on a clustering algorithm, cluster real-time events with common features to obtain attack activity clusters.

[0102] Specifically, features refer to attributes extracted from high-threat events that can be used to distinguish and compare events. These can include: source IP address, destination IP address, port number, attack method, timestamp, and tool signature used. Clustering algorithms are unsupervised machine learning techniques that automatically group events, making points within the same group similar to each other, while points in different groups are significantly different. An attack activity cluster is a group of events merged after the clustering algorithm analyzes the events in the high-threat event list. Events within the same cluster share significant common features, indicating that these events originate from the same attacker, the same botnet, or the same coordinated attack campaign. The endpoint extracts a set of predefined features from each event in the high-threat event list, inputs these feature vectors into the clustering algorithm, and automatically groups them according to the similarity between features, ultimately forming several attack activity clusters.

[0103] Step 503: If the real-time events in the attack activity cluster conform to the preset attack process, then infer the attack stage corresponding to the real-time events and obtain the attack sequence.

[0104] Specifically, a pre-defined attack flow, also known as an attack chain model, describes the stages an attacker typically goes through from initial intrusion to achieving their goal. Examples include reconnaissance, weaponization, deployment, exploitation, installation, command and control, and target action. An attack sequence is formed when events within an attack activity cluster match one or more consecutive stages in a pre-defined attack flow in terms of chronological order and operational logic. This reveals the attack's phased objectives and development direction. The terminal performs pattern matching and logical reasoning to analyze the timeline and technical details of events within the attack activity cluster. For example, a port scan of the server might occur first, followed by an exploitation attempt, and then the upload of a command execution environment. This series of events matches the early stages of the attack flow, allowing the inference of the current attack stage and the combination of these ordered events into an attack sequence.

[0105] Step 504: Based on the network topology diagram, calculate the potential business impact range of the attack sequence and obtain an attack analysis report.

[0106] The network topology diagram is a chart depicting all IT assets within an organization and their interconnections, clearly showing the possible data flow paths within the network. The potential business impact scope refers to the set of all assets an attacker could potentially access along network connections if the attack sequence were successful, and the cascading effects on related business systems. The attack analysis report is a comprehensive document integrating technical analysis results and business impact assessments. The report may include: a list of affected assets, an attack path diagram, the potential impact on specific business systems, and a quantified overall business risk value. The endpoint performs graph traversal and business impact assessment, starting with compromised or attacked assets in the attack sequence. It traverses and analyzes the network topology diagram to identify all assets that could potentially be accessed laterally. Combining this with business information from the asset database, it analyzes the impact of asset compromise on business continuity, calculates the overall risk value, and integrates all analysis results into a structured attack analysis report.

[0107] Step 505: Using the network topology map as the base map, overlay the attack analysis report to obtain the global network security situation map.

[0108] The global network security situation map is a dynamic, visual dashboard view. Using a network topology map as its underlying background, it overlays key information from attack analysis reports—including attack activity clusters, attack sequence progression paths, and the risk levels of affected assets—onto the base map using graphic elements such as highlights, colors, arrows, and animations. The terminal reads the network topology map and attack analysis report, and through a visualization engine, transforms the abstract data in the report into graphic elements. Assets under attack are highlighted in red, arrows indicate the direction of attack movement, color intensity represents risk levels, and events within the same attack activity cluster are connected by lines.

[0109] This embodiment provides a security command center view, enabling security situational awareness to instantly grasp the security status of the entire network on a single map, quickly locate hotspots, and understand the full picture and impact of attacks. By using thresholds, it greatly reduces the number of events that need to be processed by complex correlation analysis, reduces the computational burden, and helps focus on the most potentially harmful activities, avoiding being overwhelmed by a large number of low-risk alerts. Event clustering links isolated attack alerts into potential attack activities, providing a more macroscopic view and helping to understand the scale and source of attacks.

[0110] In one embodiment, based on the network topology map, the potential business impact range of the attack sequence is calculated to obtain an attack analysis report, including:

[0111] Step 601: Analyze each attack sequence and extract the target asset information pointed to by all real-time events; the target asset information includes the asset name, ownership of the business system, and importance level.

[0112] An attack sequence is a set of attack stages arranged in logical order, describing the technical process of a complete attack campaign. Target asset information is a set of business attributes of the attacked object extracted from all successful or attempted attack events included in the attack sequence. This includes business-dimensional information: the asset name is the asset's unique identifier; the business system affiliation refers to the business unit or application system to which the asset belongs; and the importance level indicates the asset's criticality to the organization's business continuity, determining the initial severity of a single point of vulnerability. The terminal parses each attack event in the attack sequence to obtain the target field, which can be the target IP address or hostname. Using this as a key, it queries the asset database to obtain detailed business information corresponding to the asset, including its name, affiliated business system, and importance level. This information from all attacked assets is then aggregated to form a target asset information list.

[0113] Step 602: Starting from the asset corresponding to the target asset information, analyze the network topology to find all other assets that can be accessed from the starting asset, and obtain the potential movement path map.

[0114] Specifically, a network topology graph is a data model or diagram describing all assets and connections in a network. It defines the allowed communication paths between assets and forms the basis for simulating attack propagation. The starting asset is an asset that has been confirmed to be attacked in the attack sequence, where the attacker has established a foothold to some extent. The potential movement path graph is a subgraph or set of paths obtained by traversing and analyzing the network topology graph with the starting asset as the root node. It shows all other assets and their paths that an attacker can progressively access starting from the starting asset, using existing network connections and potentially stolen credentials. The endpoint treats each asset in the target asset information as a starting point. On the network topology graph, it simulates its access permissions, using a breadth-first search algorithm to analyze the next-hop assets that can be directly or indirectly accessed from the starting asset via network routing, trust relationships, etc., and continues to expand until no new assets can be reached. All explored paths together constitute the potential movement path graph.

[0115] Step 603: Based on the potential mobile path map, analyze the impact of the asset attack on the business system and obtain an impact chain analysis report.

[0116] Specifically, the Impact Chain Analysis Report is a descriptive analysis that details the specific consequences for supporting business functions after a critical asset in the potential mobile path is compromised, focusing on business impacts such as business disruption and data breaches. The analysis combines the potential mobile path map with business information from the asset database. For example, if the path map shows that an attacker can access the database server from the web server, the Impact Chain Analysis Report would indicate that the core transaction database faces data breach risks, potentially leading to user information loss and compliance penalties. It would then deduce, step by step, the potential damage to the availability, integrity, and confidentiality of related business systems along the mobile path.

[0117] Step 604: Based on the importance level and impact chain analysis report, calculate the overall business risk value of the entire attack sequence.

[0118] The overall business risk score is a quantitative score calculated comprehensively to summarize the overall business risk level posed by the entire attack sequence to the organization. It is calculated by considering the importance of the assets and the severity of the impact chain. The endpoint risk is based on the rule that risk is the product of probability and impact. Probability is assessed based on factors such as the completeness of the attack sequence and threat confidence. Impact is calculated using a weighted formula, taking into account the importance level of the starting asset, the importance of other assets involved in the impact chain analysis report, and the length and breadth of the impact chain. The probability and impact scores are then combined to arrive at the overall business risk score.

[0119] Step 605: Integrate the overall business risk value, impact chain analysis report, and asset information to generate an attack analysis report.

[0120] The attack analysis report is a structured document or data object that comprehensively summarizes the technical details, business impact, and risk level of an attack campaign. It serves as the direct data source for generating a global situational awareness map. The endpoint integrates target asset information indicating which assets were directly attacked, a potential movement path map showing how the apparent threat might spread, an impact chain analysis report characterizing the specific impact of the attack on business, and an overall business risk value into a unified framework to generate a complete attack analysis report.

[0121] This embodiment provides a decision-making basis for formulating accurate emergency response plans by producing an action-oriented and comprehensive analysis conclusion; it predicts the scope of threat spread, expanding the analysis from single-point impact to the impact on the entire network, thereby improving the accuracy of network security situational awareness.

[0122] In one embodiment, after performing correlation analysis on real-time events based on threat confidence scores to obtain a global network security situation map, the method further includes:

[0123] Step 701: Based on the global network security situation map, clarify the handling objectives and obtain a list of handling objectives; and based on the list of handling objectives, match the corresponding handling actions in the response action knowledge base to obtain a list of candidate actions.

[0124] The global network security situation map is a comprehensive and visual representation of the current network risk situation, clearly indicating attack activities, affected assets, and risk levels. The response targets are specific risk points identified from the situation map that need to be mitigated or eliminated. The response target list is a checklist of all response targets analyzed from the situation map that require handling, with each target prioritized based on its risk value. The response action knowledge base is a predefined database storing various standard network security response actions, each associated with the type of response target it can address. The candidate action list is a collection of all possible specific response actions matched from the response action knowledge base for each target in the response target list. Based on the global network security situation map, the endpoint identifies key attack paths, infected assets, and abnormal connections, defining them as specific response targets, forming the response target list. Each target in this list is used as a query condition to search and match within the response action knowledge base, identifying all technically feasible response actions to achieve that target, thus forming the candidate action list.

[0125] Step 702: Based on the decision analysis model, each action in the candidate action list is evaluated in multiple dimensions to obtain a quantitative evaluation score; the evaluation dimensions include effectiveness, cost, execution speed and reversibility.

[0126] Specifically, the decision analysis model is a mathematical model used to quantitatively evaluate complex solutions. It uses a set of predefined criteria to structurally evaluate various options. The quantitative evaluation score is a comprehensive score or a set of dimensional scores calculated by the decision analysis model for each action in the candidate action list, based on multiple evaluation dimensions. Evaluation dimensions refer to criteria that measure the merits of an action from different perspectives, and may include: effectiveness (the expected effect of the action in achieving the action goal; a higher score indicates better effectiveness); cost (the resources required to execute the action, including human resources, time, financial costs, and potential impact on system performance; a higher score indicates lower cost); execution speed (the time required to implement the action and make it effective; a higher score indicates faster action); and reversibility (the ease of reversing the action and restoring the original state after misoperation or changes in circumstances; a higher score indicates easier recovery). The terminal inputs each action in the candidate action list into the decision analysis model. The model then scores each action on the above four dimensions based on historical data or predefined rules according to a preset algorithm, generating a quantitative evaluation score for each action.

[0127] Step 703: Based on the quantitative assessment score, and under the premise of meeting the preset constraints, generate a sequence of response actions with the goal of maximizing overall risk reduction and minimizing business impact.

[0128] Specifically, the preset constraints are the limitations that must be followed when executing response actions. Examples include, for instance, the maximum number of available human resources, the allowable business interruption window, budget constraints, and a list of critical systems that must remain online. Maximizing overall risk reduction is one of the core optimization objectives, meaning that the selected sequence of response actions should minimize the overall risk value represented by the global network security posture map. Minimizing business impact is another core optimization objective, meaning that the response actions themselves should not cause unnecessary interference or interruption to normal business operations. The response action sequence is an ordered, executable list of action plans, clearly defining which actions should be executed first and which should be executed later; it is the result of optimization calculations. The terminal performs optimization under constraints, using the quantitative evaluation score as input, the preset constraints as limitations, and maximizing overall risk reduction and minimizing business impact as objective functions. It performs optimization calculations, evaluates the effects of different action combinations, and ultimately generates a response action sequence with an execution order that maximizes both objectives while satisfying all constraints.

[0129] Step 704: Generate a handling recommendation based on the response action sequence; the handling recommendation is used to assist in making safe operation decisions.

[0130] The response recommendation is a structured document or set of instructions generated based on a sequence of response actions. Its content may include: an overview of the current situation, specific response steps, expected effects, rollback plans, and precautions. The terminal converts each action in the response sequence into a natural language description or executable script, supplements it with necessary contextual information, and finally assembles it into a complete and easy-to-understand response recommendation.

[0131] This embodiment generates decisions based on a security situation map, which greatly reduces the workload and decision-making pressure of security analysts, improves the speed and accuracy of emergency response, ensures the consistency between response actions and strategic objectives, and uses the disposal recommendations as an auxiliary rather than a substitute for decision-making. The final execution still requires personnel confirmation. It produces a scientific, feasible, and optimal response roadmap, ensuring that security response actions are not only effective but also efficient, and maximizing the balance between security needs and business continuity.

[0132] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0133] Based on the same inventive concept, this application also provides a network security situation awareness device based on the fusion of generative adversarial networks and large AI models for implementing the aforementioned network security situation awareness method based on the fusion of generative adversarial networks and large AI models. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the network security situation awareness device based on the fusion of generative adversarial networks and large AI models provided below can be found in the limitations of the network security situation awareness method based on the fusion of generative adversarial networks and large AI models described above, and will not be repeated here.

[0134] In one exemplary embodiment, such as Figure 2As shown, a network security situation awareness device 800 based on the fusion of generative adversarial networks and large AI models is provided, including:

[0135] Context module 801 is used to add business context to real-time events based on the asset database to obtain standard real-time events; the business context includes the importance level of the accessed asset and at least one of the business systems to which the accessed asset belongs.

[0136] The scoring module 802 is used to input each standard real-time event into the threat assessment model to obtain the threat confidence score for the corresponding single real-time event; the threat confidence score represents the probability that the real-time event is a real threat;

[0137] Analysis module 803 is used to perform correlation analysis on real-time events based on threat confidence scores to obtain a global network security situation map; the global network security situation map is used to characterize the risk status faced by the entire network environment.

[0138] Furthermore, the device also includes a model module for:

[0139] Historical cybersecurity incidents are standardized to obtain standardized security incidents; and based on labels, these standardized security incidents are classified to obtain a basic training dataset; the labels include real threats and normal behaviors, which are used to characterize the threatening nature of cybersecurity incidents.

[0140] Random noise is input into the generator of the adversarial network to generate a set of simulated threat events;

[0141] Event samples in the simulated threat event set are labeled as threats and merged with the basic training dataset to obtain the enhanced training dataset;

[0142] The threat assessment model is obtained by using an enhanced training dataset as the training set and performing supervised fine-tuning on a large language model. The input of the threat assessment model is the features and context of the threat event sample, and the output is the confidence probability that the threat event sample is a real threat.

[0143] Furthermore, the model module is also used for:

[0144] The threat event samples are obtained by filtering out event samples classified as real threats from the basic training dataset;

[0145] A batch of threat event samples is mixed with the initial generated samples generated by the generator to obtain a mixed sample; the mixed sample is then input into the discriminator of the adversarial network to obtain the discrimination result.

[0146] Based on the discrimination results, the loss function of the discriminator is calculated; and based on the loss function, the neural network weights of the discriminator are updated to obtain the updated discriminator.

[0147] The newly generated samples, based on the new random noise, are input into the updated discriminator to obtain a new discrimination result; the loss value of the generator is calculated based on the new discrimination result.

[0148] With the discriminator parameters fixed, the neural network weights of the generator are updated to obtain the updated generator. When the updated generator and the updated discriminator meet the preset iteration stopping condition, the iteration is stopped, and the generator is obtained.

[0149] Furthermore, the model module is also used for:

[0150] Mini-batch samples are extracted from the augmented training dataset, and the mini-batch samples are preprocessed to obtain mini-batch training data.

[0151] A small batch of training data is input into a large language model to obtain the prediction result for each input sample; the prediction result is then compared with the true label, and the loss value is obtained using the following formula:

[0152]

[0153] Where L is the loss value, N is the batch size, and i is the sample index. Let i be the true label of the i-th sample. Let be the predicted probability of the model for the i-th sample;

[0154] The parameters of the large language model are updated based on the loss value to obtain the updated large language model;

[0155] The updated large language model was evaluated using a validation dataset to obtain the performance evaluation results.

[0156] Large language models whose performance evaluation results meet the preset training termination conditions are identified as threat assessment models.

[0157] Furthermore, the analysis module 803 is also used for:

[0158] Real-time events with threat confidence scores not greater than a preset threshold are removed to obtain a list of high-threat events.

[0159] Extract features from real-time events in the high-threat event list; and based on a clustering algorithm, cluster real-time events with common features to obtain attack activity clusters;

[0160] If the real-time events in the attack activity cluster conform to the preset attack flow, the attack stage corresponding to the real-time event is inferred, and the attack sequence is obtained.

[0161] Based on the network topology diagram, the potential business impact range of the attack sequence is calculated, and an attack analysis report is obtained.

[0162] Using the network topology map as a base map, an attack analysis report is overlaid to obtain a global network security situation map.

[0163] Furthermore, the analysis module 803 is also used for:

[0164] Analyze each attack sequence and extract the target asset information pointed to by all real-time events; the target asset information includes the asset name, ownership of the business system, and importance level;

[0165] Starting with the asset corresponding to the target asset information, analyze the network topology to find all other assets that can be accessed from the starting asset, and obtain the potential movement path map;

[0166] Based on the potential mobile path map, the impact of asset attacks on business systems is analyzed, and an impact chain analysis report is obtained.

[0167] Based on the importance level and impact chain analysis report, calculate the overall business risk value of the entire attack sequence;

[0168] Integrate overall business risk values, impact chain analysis reports, and asset information to generate an attack analysis report.

[0169] Furthermore, the device also includes a decision module for:

[0170] Based on the global network security situation map, the objectives of the response are identified and a list of objectives is obtained. Then, based on the list of objectives, the corresponding actions are matched in the response action knowledge base to obtain a list of candidate actions.

[0171] Based on the decision analysis model, each action in the candidate action list is evaluated from multiple dimensions to obtain a quantitative evaluation score; the evaluation dimensions include effectiveness, cost, execution speed and reversibility.

[0172] Based on the quantitative assessment score, and under the premise of meeting the preset constraints, a sequence of response actions is generated with the goal of maximizing the reduction of overall risk and minimizing the impact on business.

[0173] Based on the response action sequence, a handling recommendation is generated; the handling recommendation is used to assist in making safe operation decisions.

[0174] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of a network security situational awareness method based on the fusion of generative adversarial networks and AI large models as described above.

[0175] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0176] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0177] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A network security situational awareness method based on the fusion of generative adversarial networks and large AI models, characterized in that, The method includes: Based on the asset database, a business context is added to a real-time event to obtain a standard real-time event; the business context includes the importance level of the accessed asset and at least one of the business systems to which the accessed asset belongs. Each of the aforementioned standard real-time events is input into the threat assessment model to obtain a threat confidence score for each individual real-time event; the threat confidence score represents the probability that the real-time event is a real threat. Based on the threat confidence score, the real-time events are correlated and analyzed to obtain a global network security situation map; the global network security situation map is used to characterize the risk status faced by the entire network environment.

2. The method according to claim 1, characterized in that, The threat assessment model was obtained through the following method: Historical cybersecurity incidents are standardized to obtain standardized security incidents; and based on labels, the standardized security incidents are classified to obtain a basic training dataset; the labels include real threats and normal behaviors, which are used to characterize the threatening nature of the cybersecurity incidents. Random noise is input into the generator of the adversarial network to generate a set of simulated threat events; The event samples in the simulated threat event set are labeled as threats and merged with the basic training dataset to obtain the enhanced training dataset; The enhanced training dataset is used as the training set, and supervised fine-tuning is performed on a large language model to obtain the threat assessment model. The input of the threat assessment model is the features and context of the threat event sample, and the output is the confidence probability that the threat event sample is the real threat.

3. The method according to claim 2, characterized in that, The generator was trained using the following method: Event samples belonging to the category of the real threat are selected from the basic training dataset to obtain threat event samples; A batch of threat event samples and the initial generated samples generated by the generator are mixed to obtain a mixed sample; the mixed sample is then input into the discriminator of the adversarial network to obtain a discrimination result. Based on the discrimination result, the loss function of the discriminator is calculated; and based on the loss function, the neural network weights of the discriminator are updated to obtain the updated discriminator. The newly generated samples, generated by the generator based on the new random noise, are input into the updated discriminator to obtain a new discrimination result; Based on the new discrimination result, the loss value of the generator is calculated; By fixing the parameters of the discriminator and updating the neural network weights of the generator, an updated generator is obtained. When the updated generator and the updated discriminator meet the preset iteration stop condition, the iteration stops, and the generator is obtained.

4. The method according to claim 2, characterized in that, The step of using the enhanced training dataset as a training set and performing supervised fine-tuning on a large language model to obtain the threat assessment model includes: Mini-batch samples are extracted from the enhanced training dataset, and the mini-batch samples are preprocessed to obtain mini-batch training data. The mini-batch training data is input into the large language model to obtain the prediction result for each input sample; the prediction result is then compared with the true label, and the loss value is obtained using the following formula: Where L is the loss value, N is the batch size, and i is the sample index. Let i be the true label of the i-th sample. Let be the predicted probability of the model for the i-th sample; The parameters of the large language model are updated based on the loss value to obtain the updated large language model; The updated large language model was evaluated using a validation dataset to obtain performance evaluation results. The large language model whose performance evaluation results meet the preset training termination conditions is identified as the threat assessment model.

5. The method according to claim 1, characterized in that, The process of performing correlation analysis on the real-time events based on the threat confidence score to obtain a global network security situation map includes: The real-time events with threat confidence scores not greater than a preset threshold are removed to obtain a list of high-threat events. Extract features from the real-time events in the high-threat event list; and based on a clustering algorithm, cluster the real-time events that share the same features to obtain attack activity clusters; If the real-time events in the attack activity cluster conform to the preset attack flow, then the attack stage corresponding to the real-time events is inferred, and the attack sequence is obtained; Based on the network topology diagram, the potential business impact range of the attack sequence is calculated, and an attack analysis report is obtained. Using the network topology map as a base map, the attack analysis report is overlaid to obtain the global network security situation map.

6. The method according to claim 5, characterized in that, The process of calculating the potential service impact range of the attack sequence based on the network topology map, and obtaining an attack analysis report, includes: Each attack sequence is analyzed to extract the target asset information pointed to by all the real-time events; the target asset information includes the asset name, the ownership of the business system, and the importance level; Starting with the asset corresponding to the target asset information, the network topology is analyzed to find all other assets that can be accessed from the starting asset, thus obtaining a potential movement path map. Based on the potential mobile path map, the impact of the attack on the asset on the business system is analyzed, and an impact chain analysis report is obtained. Based on the importance level and the impact chain analysis report, calculate the overall business risk value of the entire attack sequence; The attack analysis report is generated by integrating the overall business risk value, the impact chain analysis report, and the asset information.

7. The method according to claim 1, characterized in that, After performing correlation analysis on the real-time events based on the threat confidence score to obtain a global network security situation map, the process further includes: Based on the global network security situation map, the action targets are identified and a list of action targets is obtained; and based on the list of action targets, the corresponding action is matched in the response action knowledge base to obtain a list of candidate actions. Based on the decision analysis model, each of the disposal actions in the candidate action list is evaluated in multiple dimensions to obtain a quantitative evaluation score; the evaluation dimensions include effectiveness, cost, execution speed, and reversibility. Based on the quantitative evaluation score, and under the premise of meeting the preset constraints, a sequence of response actions is generated with the goal of maximizing overall risk reduction and minimizing business impact. Based on the response action sequence, a handling recommendation is generated; the handling recommendation is used to assist in making safe operation decisions.

8. A network security situational awareness device based on the fusion of generative adversarial networks and large AI models, characterized in that, The device includes: The context module is used to add business context to real-time events based on the asset database to obtain standard real-time events; the business context includes the importance level of the accessed asset and at least one of the business systems to which the accessed asset belongs. The scoring module is used to input each of the aforementioned standard real-time events into the threat assessment model to obtain a threat confidence score for each individual real-time event; the threat confidence score represents the probability that the real-time event is a real threat. The analysis module is used to perform correlation analysis on the real-time events based on the threat confidence score to obtain a global network security situation map; the global network security situation map is used to characterize the risk status faced by the entire network environment.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images