Network security threat detection system and method based on domain adaptive security big model

Abstract

The invention discloses a network security threat detection system and method based on a domain adaptive security big model, and the method comprises the steps: building the domain adaptive security big model facing power system threats: carrying out the systematic collection and management of a corpus in the power security field, and carrying out the domain knowledge injection based on the corpus in the power security field; performing instruction fine tuning for an electric power safety analysis task: constructing a high-quality instruction data set, and performing supervision fine tuning, model verification and evaluation on the model by using the instruction data set according to a typical threat scene of an electric power system by adopting a parameter efficient fine tuning method; acquiring multi-source security data of the electric power system and performing context preprocessing; power threat multi-dimensional analysis and reasoning based on a large security model; threat report generation and automatic response can be explained; continuously optimizing the model based on feedback; and constructing a field adaptive security large model oriented to the power system threat. The method has the characteristics of high accuracy, low delay, enhanced interpretability and the like.

Description

Technical Field

[0001] This invention relates to a network security threat detection system and method based on a domain-adaptive security big model, belonging to the field of artificial intelligence in the technology of network security. Background Technology

[0002] Existing cybersecurity threat detection technologies, such as feature-based intrusion detection systems, static rule-based security information and event management systems, and traditional machine learning models, generally suffer from the following shortcomings: First, they lack the ability to detect unknown threats and variant attacks, heavily relying on predefined signatures or rules. Second, these methods have a high false positive rate, generating a large number of alerts that require manual interpretation by security analysts, leading to alert fatigue. Third, traditional solutions lack in-depth contextual analysis capabilities and reasonable interpretation of detection results, making it difficult for security personnel to quickly understand the full picture and intent of an attack.

[0003] While large language models demonstrate powerful reasoning capabilities in general natural language tasks, directly applying them to the highly specialized field of cybersecurity creates a "domain gap." General-purpose models lack a deep understanding of cybersecurity terminology and attack tactics, and their outputs may contain factual errors or be unstable, failing to meet the high accuracy and reliability requirements of threat detection. Therefore, there is an urgent need for a technical solution that can deeply integrate the general capabilities of large language models with cybersecurity expertise.

[0004] To address the aforementioned problems, this invention constructs a network security threat detection system and method based on a large-scale security model. The system includes: a data acquisition and preprocessing module for acquiring and standardizing multi-source security data; a domain-adaptive large-scale security model core engine module, serving as the system's intelligent hub, composed of a large model enhanced with network security domain knowledge and fine-tuned by instructions; a model management and update module for continuous learning based on feedback; and a detection result output and response module for generating interpretable reports and executing responses. The method includes: a step of constructing a domain-adaptive large-scale security model, optimizing the general large model into a network security expert model through continued pre-training and instruction fine-tuning; a step of performing contextual analysis and intelligent reasoning on real-time security data to identify threat indicators and attack intentions; a step of outputting an interpretable report containing evidence and recommendations; and a step of continuously optimizing the model based on expert feedback. Summary of the Invention

[0005] This invention provides a network security threat detection method based on a domain-adaptive security big model. It addresses the diverse threats faced by power systems, such as ransomware attacks, DDoS attacks, data breaches, phishing emails, IoT device risks, and supply chain attacks, achieving high accuracy, low latency, and enhanced interpretability in threat detection.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0007] A network security threat detection method based on a domain-adaptive security model includes the following steps:

[0008] Step 1: Construct a domain-adaptive security model for power system threats, including:

[0009] Step 101: Systematic collection and governance of corpora in the field of power safety. This step is the foundation for building a high-quality model.

[0010] First, a comprehensive collection of professional corpus on power system cybersecurity was conducted to form the original corpus. The main sources of this corpus include: 1) technical standards and protocol specifications; 2) vulnerability and threat intelligence, which includes vulnerability descriptions, risk analyses, and solutions related to power equipment, selected from vulnerability databases such as CVE / NVD and CNVD; 3) attack knowledge bases, integrating MITRE, ATT&CK, ICS frameworks, historical security incident analysis reports from the power industry, and malware analysis records; and 4) security protection regulations, incorporating national and industry-issued security protection regulations and guidelines for power monitoring systems.

[0011] Subsequently, data governance was carried out on the original corpus, including: data cleaning (removing irrelevant characters and duplicates), format standardization (unifying to structured formats such as JSON or XML), privacy desensitization (anonymizing the IP addresses, hostnames, and unit names involved), and a dedicated power safety dictionary was built to improve the accuracy of subsequent word segmentation. Finally, a high-quality and compliant power safety corpus that has been cleaned, standardized, and desensitized was output.

[0012] Step 102: Domain knowledge injection based on power corpus. This step aims to deeply integrate power safety knowledge into the model parameters:

[0013] A general pre-trained large language model is selected as the basis. Then, the power security corpus obtained in step 101 is used to continue pre-training the basic model. In this process, self-supervised learning objectives such as masked language modeling are adopted to enable the model to learn and master the professional terminology, protocol instruction semantics, typical attack patterns and security strategies of the power system.

[0014] Step 103: Fine-tuning instructions for power security analysis tasks. After the model acquires domain knowledge, this step aims to teach the model how to use this knowledge to perform specific security analysis tasks.

[0015] First, a high-quality instruction dataset is constructed, designed for typical threat scenarios in power systems, containing a "instruction-input-expected output" triple. For example: Instruction: "Analyze the following network traffic sequence to determine if there are any signs of a DDoS attack targeting power control systems (such as SCADA)." Input: "Within 2 minutes, over 100,000 different IPs continuously send TCPSYN requests to port 502 (Modbus TCP) of the substation control server, resulting in slow server response." Expected output: "High confidence alert: Suspected protocol-based DDoS attack (TCP SYN Flood). This behavior aims to exhaust the communication resources of the control system and may affect real-time power monitoring. Recommendation: Initiate traffic scrubbing and check the firewall's blocking policy for abnormal source IPs."

[0016] Then, a parameter-efficient fine-tuning method is adopted, and the model is supervised and fine-tuned using this instruction dataset. This process can greatly reduce the computational cost while accurately stimulating the domain knowledge learned by the model in the pre-training stage, enabling it to learn to follow human instructions and generate outputs that conform to the logic and format specifications of power safety analysis.

[0017] Step 104: Model Validation and Evaluation. After fine-tuning the instructions, the model performance needs to be rigorously validated.

[0018] The model is evaluated using a test set independent of the training set, which includes various power system threat scenarios. Evaluation metrics include not only threat detection accuracy and recall, but also, and more importantly, the reasonableness and interpretability of its output. Only models that can stably and accurately identify threats and provide clear reasoning processes and remediation recommendations are considered qualified domain-adaptive security models and permitted for deployment in subsequent threat detection processes.

[0019] Step 2: Acquisition and context preprocessing of multi-source security data of the power system;

[0020] Step 3: Multi-dimensional analysis and reasoning of power threats based on a large security model;

[0021] Step four allows for the interpretation of threat report generation and automated response;

[0022] Step 5: Continuously optimize the model based on feedback.

[0023] The above methods enable intelligent detection and response.

[0024] In step 101 above, the technical standards and protocol specifications include core protocol texts for power industrial control systems such as IEC 61850, IEC 60870-5-104, and DNP3.

[0025] Step two above, the acquisition and context preprocessing of multi-source security data of the power system, includes:

[0026] Step 201: Multi-source heterogeneous data acquisition and aggregation:

[0027] By deploying acquisition probes and agents in different zones of the power network, a full range of security data is collected in real time or offline. The data sources include: 1) Information networks (IT), including office network traffic and server access logs; 2) Industrial control networks (OT), focusing on collecting communication traffic from critical facilities such as SCADA systems, power generation control units, and distribution automation terminals, especially communication messages based on IEC 61850, DNP3, and Modbus protocols; 3) Security facilities, collecting security alarms and operation logs from firewalls, intrusion detection systems, and security audit platforms; 4) Terminal devices, collecting security events from engineer workstations, operator workstations, smart meters, and mobile maintenance terminals; and 5) External intelligence, accessing the latest vulnerability announcements, threat indicators, and attack group intelligence covering the power industry. All data is aggregated through a unified data bus to obtain the aggregated raw data, providing raw materials for subsequent processing.

[0028] Step 202: Contextual Data Governance and Enhancement for Electricity Business:

[0029] The aggregated raw data undergoes in-depth governance to construct a model-understandable context. First, protocol parsing and standardization are performed, using a dedicated parsing engine to deeply decode industrial control protocols and extract key fields such as function codes and operation values. Next, execution time synchronization and alignment are implemented, unifying the timestamps of logs from different sources to a standard time. A crucial step is business context enhancement, which associates IP addresses with their respective power functional zones through the asset management system and labels operational behaviors with business semantics. Finally, privacy and sensitive information are de-identified, with personnel accounts and specific parameter values ​​masked or hashed to ensure compliance.

[0030] Step 203: Constructing Natural Language Descriptions:

[0031] To achieve optimal understanding of large models, the system transforms the managed structured data into natural language descriptions rich in business semantics. It employs predefined templates and rules to combine discrete log entries into coherent narratives. For example, a raw login failure event {src_ip: '10.1.1.100', user: 'admin', dst_host: 'scada-svr', time: '2024-11-09 10:00:00', result: 'failure'} will be transformed into: "Time: 2024-11-09 10:00:00; Source: IP address 10.1.1.100 (Engineer Station A); Destination: SCADA server; Event: User 'admin' attempted login; Status: Failed." This format provides high-quality input with a clear business context for large models.

[0032] Step three above, the multi-dimensional analysis and reasoning of power threats based on the large-scale security model, includes:

[0033] Step 301: Lateral Contextual Analysis: The model analyzes the propagation patterns of suspicious behavior among different nodes in the power network within the same time window. When the model identifies signs of a terminal being compromised, it immediately searches and analyzes whether the terminal has attempted to communicate or log in to other critical assets in the network (such as SCADA servers, power metering systems, and power generation control units) in a short period of time. By identifying this lateral movement pattern based on "stepping stones," the model can promptly detect the attacker's penetration and spread behavior in the power intranet and outline potential infection paths.

[0034] Step 302: Vertical Contextual Correlation Analysis: The model dynamically compares the currently observed events with the historical normal behavior baselines of target entities such as users, hosts, and terminals. If an anomaly is found, a warning is issued. For example, if an operations and maintenance account that usually only logs into the system and performs specific query operations during weekday office hours suddenly initiates access to high-risk commands such as modifying protection settings or remotely controlling circuit breakers during non-working hours at night, the model will combine its historical behavior patterns to determine that this operation is a serious anomaly, which may indicate credential theft or internal threats, and thus issue a high-priority alarm.

[0035] Step 303: External Intelligence Correlation and Attack Chain Reconstruction: The model performs real-time matching and verification of suspicious indicators such as malicious IPs, virus hashes, and abnormal domain names generated from internal analysis with the accessed external threat intelligence database to confirm their malice and the threat organization to which they belong. In addition, the model can use its learned attack knowledge to intelligently connect multiple discrete security events to reconstruct a complete "attack chain" that conforms to the attack logic; for example: phishing email delivery -> malicious script execution on the engineer's station -> internal network port scanning -> successful login to the SCADA server -> abnormal database query. Based on this, the model will assess the ultimate potential impact of this attack chain on the operation of the power system, such as whether it may lead to unplanned generator shutdowns, partial power outages in the distribution network, or serious accidents such as monitoring data tampering, thus providing key evidence for risk assessment.

[0036] Step four above explains threat report generation and automated response, including:

[0037] Step 401: Generate a structured, interpretable threat report: The model output is no longer a simple binary judgment, but a clearly structured and well-supported natural language analysis report. The report must include the following core elements: 1) Threat determination, clearly indicating the specific threat type, such as "lateral movement in the early stages of a ransomware attack"; 2) Confidence level, showing the degree of confidence of the model's judgment as a percentage; 3) Correlation evidence, clearly listing key log entries, behavioral patterns, or traffic characteristics that support the judgment; 4) Attack intent reasoning, deeply analyzing the attacker's ultimate goal, such as "This series of actions aims to gain control of the SCADA system and may be intended to launch a large-scale blackout attack"; 5) Remediation recommendations, providing specific and actionable initial mitigation measures, such as "It is recommended to immediately isolate the infected host on the network and verify the integrity of the backup data."

[0038] Step 402: Integration with the Power Safety Operation and Maintenance System: Through deep integration with the power company's existing safety operation and maintenance platform via standardized APIs, the system can automatically or manually execute response actions based on the level and content of threat reports. For example: automatically adding rules to industrial control firewalls to block malicious IP access; remotely isolating confirmed compromised smart meters through the terminal management platform; issuing warning messages to dispatching personnel, prompting them to review specific control commands; or triggering a pre-set "data leakage" handling script on the SOAR platform, coordinating multiple security devices for a collaborative response; using the reward model to evaluate the model output quality and generate reinforcement signals.

[0039] In step five above, the model is continuously optimized based on feedback, including:

[0040] Step 501: Feedback Data Collection and Labeling: In the daily use of security operations and maintenance, the system will record all interactive operations of security analysts on the model output. When an analyst confirms that an alarm is a real threat, or corrects the model's wrong judgment (such as marking a false alarm as "benign"), or supplements the judgment information not mentioned by the model, these operations, along with their corresponding raw data, model output and final correct conclusion, will be automatically collected and stored in the feedback database. This process is essentially the digital labeling of the knowledge of human experts.

[0041] Step 502: Incremental Training and Model Iteration: The system periodically uses accumulated feedback data to incrementally train the deployed domain-adaptive security model. The training process usually adopts a parameter-efficient fine-tuning method to "feed" the model with new knowledge from human experts in a low-cost manner. For example, when a new attack pattern targeting distributed photovoltaic inverters is first discovered and confirmed by experts, the model can learn the characteristics of the pattern through incremental training, so as to achieve accurate identification when similar attacks occur in the future.

[0042] Step 503: Model Performance Evaluation and Deployment: Each new model version generated after incremental training undergoes rigorous performance evaluation on an independent test set containing known threat scenarios. Only when it is confirmed that its accuracy, recall, and other key metrics are no lower than the original version, and no new serious biases are introduced, will the new model be approved for deployment, updating the existing production environment through smooth replacement or parallel operation. Thus, the system forms a closed loop of "detection -> feedback -> learning -> optimization -> re-detection," ultimately achieving continuous evolution of the model, making it increasingly intelligent with use in the specific security environment of the power system.

[0043] A network security threat detection system based on a domain-adaptive security model includes the following core modules:

[0044] Data Acquisition and Preprocessing Module: This module is responsible for collecting multi-source heterogeneous raw security data from network devices, security devices, servers, terminals, and external threat intelligence sources. It then cleans, denoises, standardizes, and extracts features from this data, converting structured log entries into natural language descriptions to facilitate understanding and processing by subsequent large-scale models. The collected multi-source heterogeneous raw security data includes: 1) technical standards and protocol specifications; 2) vulnerability and threat intelligence, filtering vulnerability descriptions, risk analyses, and solutions related to power equipment from vulnerability databases such as CVE / NVD and CNVD; 3) attack knowledge base, integrating MITRE, ATT&CK, ICS frameworks, historical security event analysis reports from the power industry, and malware analysis records; and 4) security protection regulations, incorporating national and industry-issued security protection regulations and guidelines for power monitoring systems.

[0045] Domain Adaptive Security Model Core Engine Module: This module is the intelligent hub of the system, carrying a security model trained in two stages. The first stage is further pre-training with domain knowledge enhancement, using massive cybersecurity corpora to train the general model and enable it to master professional domain knowledge. The second stage is instruction fine-tuning for security analysis tasks, using a carefully constructed instruction dataset to optimize the model, enabling it to perform specific security analysis tasks. This module receives preprocessed data and performs deep reasoning and contextual analysis. Instruction fine-tuning for security analysis tasks includes: constructing a high-quality instruction dataset designed for typical threat scenarios in power systems, containing "instruction-input-expected output" triples; and then using an efficient parameter fine-tuning method, using this instruction dataset for supervised fine-tuning of the model.

[0046] Detection Result Output and Response Module: This module receives the structured analysis results output by the core engine module and generates an easy-to-understand threat report. At the same time, it integrates with the existing security operation and maintenance system and automatically or semi-automatically triggers response actions such as alarms, traffic blocking, and host isolation according to preset policies.

[0047] Model Management and Update Module: This module is responsible for version control, online deployment, and lifecycle management of the large security model. It integrates a feedback learning loop, which can collect the correction opinions of security analysts on the model output and use this feedback data to perform regular incremental learning and optimization of the model, enabling the system to have continuous evolution capabilities.

[0048] The core engine module of the aforementioned domain-adaptive security big data model receives preprocessed data and performs deep reasoning and contextual analysis, including:

[0049] A. Acquisition and context preprocessing of multi-source security data in power systems:

[0050] Multi-source heterogeneous data acquisition and aggregation: Through acquisition probes and agents deployed in different partitions of the power network, full-volume security data is collected in real-time or offline. Data sources include: 1) Information networks (IT), including office network traffic and server access logs; 2) Industrial control networks (OT), focusing on collecting communication traffic from critical facilities such as SCADA systems, power generation control units, and distribution automation terminals, especially communication messages based on IEC 61850, DNP3, and Modbus protocols; 3) Security facilities, collecting security alarms and operation logs from firewalls, intrusion detection systems, and security audit platforms; 4) Terminal devices, collecting security events from engineer workstations, operator workstations, smart meters, and mobile maintenance terminals; 5) External intelligence, accessing the latest vulnerability announcements, threat indicators, and attack group intelligence covering the power industry. All data is aggregated through a unified data bus to obtain the aggregated raw data, providing raw materials for subsequent processing.

[0051] Contextual Data Governance and Enhancement for Power Business: Deep governance of aggregated raw data is performed to construct a model-understandable context. First, protocol parsing and standardization are conducted, using a dedicated parsing engine to deeply decode industrial control protocols and extract key fields such as function codes and operation values. Next, execution time synchronization and alignment are performed, unifying the timestamps of logs from different sources to a standard time. A crucial step is business context enhancement, which associates IP addresses with their respective power functional zones through the asset management system and labels operational behaviors with business semantics. Finally, privacy and sensitive information are de-identified, with personnel accounts and specific parameter values ​​masked or hashed to ensure compliance.

[0052] Natural Language Description Construction: To achieve optimal understanding of large models, the system transforms well-governed structured data into natural language descriptions rich in business semantics. Using predefined templates and rules, the system combines discrete log entries into coherent narratives. For example, a raw login failure event {src_ip: '10.1.1.100', user: 'admin', dst_host: 'scada-svr', time: '2024-11-09 10:00:00', result: 'failure'} will be transformed into: "Time: 2024-11-09 10:00:00; Source: IP address 10.1.1.100 (Engineer Station A); Destination: SCADA server; Event: User 'admin' attempted login; Status: Failed." This format provides high-quality input with a clear business context for large models.

[0053] B. Multi-dimensional analysis and reasoning of power threats based on a large-scale security model:

[0054] Lateral contextual analysis: The model analyzes the propagation patterns of suspicious behavior among different nodes in the power network within the same time window. When the model identifies signs of a terminal being compromised, it immediately searches and analyzes whether the terminal has attempted to communicate or log in to other critical assets in the network (such as SCADA servers, power metering systems, and power generation control units) in a short period of time. By identifying this lateral movement pattern based on "stepping stones", the model can promptly detect the attacker's penetration and spread behavior in the power intranet and outline potential infection paths.

[0055] Vertical contextual correlation analysis: The model dynamically compares the currently observed events with the historical normal behavior baselines of target entities such as users, hosts, and terminals. If an anomaly is found, a warning is issued. For example, if an operations and maintenance account that usually only logs into the system and performs specific query operations during weekday office hours suddenly initiates access to high-risk commands such as modifying protection settings or remotely controlling circuit breakers during non-working hours at night, the model will combine its historical behavior patterns to determine that this operation is a serious anomaly, which may indicate credential theft or internal threats, and thus issue a high-priority alarm.

[0056] External intelligence correlation and attack chain reconstruction: The model performs real-time matching and verification of suspicious indicators such as malicious IPs, virus hashes, and abnormal domain names generated from internal analysis with access to external threat intelligence databases to confirm their malice and the threat organization to which they belong. In addition, the model can use its learned attack knowledge to intelligently connect multiple discrete security events to reconstruct a complete "attack chain" that conforms to the attack logic; for example: phishing email delivery -> malicious script execution on the engineer's station -> internal network port scanning -> successful login to the SCADA server -> abnormal database query. Based on this, the model will assess the ultimate potential impact of this attack chain on the operation of the power system, such as whether it may lead to unplanned generator outages, partial power outages in the distribution network, or serious accidents such as monitoring data tampering, thus providing key evidence for risk assessment.

[0057] The above detection result output and response module reports the following: 1) Threat determination, clearly indicating the specific threat type, such as "lateral movement in the early stages of a ransomware attack"; 2) Confidence level, displaying the degree of certainty of the model's judgment as a percentage; 3) Correlation evidence, clearly listing key log entries, behavioral patterns, or traffic characteristics that support the judgment; 4) Attack intent reasoning, deeply analyzing the attacker's ultimate goal, such as "This series of actions aims to gain control of the SCADA system and may be intended to launch a large-scale blackout attack"; 5) Handling recommendations, providing specific and actionable initial mitigation measures, such as "It is recommended to immediately isolate the infected host from the network and verify the integrity of the backup data."

[0058] Integration with Security Operations and Maintenance Systems: Through standardized APIs and deep integration with the power company's existing security operations and maintenance platforms, the system can automatically or manually execute response actions based on the level and content of threat reports. Examples include: automatically adding rules to industrial control firewalls to block malicious IP access; remotely isolating confirmed compromised smart meters through the terminal management platform; issuing warning messages to dispatching personnel, prompting them to review specific control commands; or triggering a pre-set "data leak" handling script on the SOAR platform, coordinating multiple security devices for a collaborative response; and using the reward model to evaluate the quality of model output and generate reinforcement signals.

[0059] The aforementioned model management and update module collects feedback from security analysts on the model output and uses this feedback data to perform regular incremental learning and optimization of the model, including:

[0060] Feedback data collection and annotation: In the daily use of security operations and maintenance, the system will record all interactive operations of security analysts on the model output. When an analyst confirms that an alarm is a real threat, or corrects the model's wrong judgment (such as marking a false alarm as "benign"), or supplements the judgment information not mentioned by the model, these operations, along with their corresponding raw data, model output and final correct conclusion, will be automatically collected and stored in the feedback database. This process is essentially the digital annotation of the knowledge of human experts.

[0061] Incremental training and model iteration: The system periodically uses accumulated feedback data to incrementally train the deployed domain-adaptive security model. The training process usually adopts a parameter-efficient fine-tuning method to "feed" the model with new knowledge from human experts in a low-cost way. For example, when a new attack pattern targeting distributed photovoltaic inverters is first discovered and confirmed by experts, the model can learn the characteristics of the pattern through incremental training, so as to achieve accurate identification when similar attacks occur in the future.

[0062] Model performance evaluation and deployment: After each incremental training, the generated new model version undergoes rigorous performance evaluation on an independent test set containing known threat scenarios. Only when it is confirmed that the new model's accuracy, recall, and other key metrics are no lower than the original version, and no new serious biases are introduced, will the new model be approved for deployment, updating the existing production environment through smooth replacement or parallel operation. Thus, the system forms a closed loop of "detection -> feedback -> learning -> optimization -> re-detection," ultimately enabling the model to continuously evolve and become increasingly intelligent under the specific security environment of the power system.

[0063] General-purpose large language models lack a deep understanding of cybersecurity terminology, attack techniques and tactics (such as the ATT&CK framework), vulnerability principles, and security strategies. This leads to factual errors, semantic biases, and misleading results when directly applied to threat detection, resulting in low credibility and practicality. This invention addresses the domain gap between general-purpose large models and the cybersecurity field.

[0064] Systems based on fixed rules and signatures cannot effectively identify new and complex attack patterns such as zero-day attacks and advanced persistent threats; while traditional machine learning models rely on manual feature engineering, have weak generalization ability, and struggle to correlate complete attack chains from massive, multi-source alert data. This invention overcomes the shortcomings of traditional detection methods in detecting unknown threats and complex attack chains.

[0065] Existing solutions generate numerous duplicate and false alarms, drowning out real threats and forcing security analysts to spend a significant amount of time on manual analysis. This results in slow response times, low overall operational efficiency, and an inability to meet the demands of real-time security defense. This invention addresses the core pain points of high false alarms and low efficiency in security operations.

[0066] Any techniques not mentioned in this invention are based on existing technologies.

[0067] Compared with the prior art, the present invention has the following beneficial effects:

[0068] (1) Improved detection capability for complex threats: Based on the semantic understanding and reasoning mechanism of large models, it can identify attack patterns that are difficult to detect by traditional methods, such as multi-stage attacks and low-frequency slow attacks. Through sequence pattern recognition and attack chain semantic analysis, it can discover complex attacks that cannot be identified by traditional feature matching or statistical anomaly detection methods.

[0069] (2) Reduced false alarm rate: By using contextual correlation analysis technology, behavioral baselines for devices, users, and business operations are established. Combined with cross-validation of multi-source data, normal business operations and malicious behavior can be effectively distinguished. Compared with traditional single-point detection methods, this can reduce false alarms caused by factors such as peak business periods and network topology changes.

[0070] (3) Full-process automated analysis is achieved: An automated pipeline is built from data collection and threat analysis to response and handling. It is integrated with existing security equipment through standardized interfaces to achieve full lifecycle management of security incidents. The system supports automated judgment and handling suggestion generation, significantly reducing the need for manual intervention.

[0071] (4) Provides interpretable detection results: A structured report output mechanism is adopted, with each threat determination accompanied by a chain of related evidence, behavioral analysis basis, and threat rating explanation. This mechanism enables security personnel to trace the model decision-making process, verify the judgment logic, and improve the credibility of the analysis results.

[0072] (5) Support for continuous optimization and evolution: Establish a reinforcement learning mechanism based on human feedback, and form an incremental training dataset through the annotation and correction of model output by security experts. The system supports online learning and hot model updates, and can adapt to new attack methods and changes in business environment to maintain the timeliness of detection capabilities. Attached Figure Description

[0073] Figure 1 This is a schematic diagram of the network security threat detection system based on a domain-adaptive security big model according to the present invention;

[0074] Figure 2 This is a flowchart of the network security threat detection method based on a domain-adaptive security big model of the present invention; Detailed Implementation

[0075] To better understand the present invention, the following embodiments further illustrate the content of the present invention, but the content of the present invention is not limited to the following embodiments.

[0076] This invention discloses a network security threat detection method based on a domain-adaptive security model. Addressing the diverse threats faced by power systems, including ransomware attacks, DDoS attacks, data breaches, phishing emails, IoT device risks, and supply chain attacks, this method achieves high accuracy, low latency, and enhanced interpretability in threat detection. Intelligent detection and response are achieved through the following steps:

[0077] Step 1: Construct a domain-adaptive security model for power system threats;

[0078] Step 2: Acquisition and context preprocessing of multi-source security data of the power system;

[0079] Step 3: Multi-dimensional analysis and reasoning of power threats based on a large security model;

[0080] Step four allows for the interpretation of threat report generation and automated response;

[0081] Step 5: Continuously optimize the model based on feedback.

[0082] Step 1: Construct a domain-adaptive security model for power system threats.

[0083] Step 101: Systematic Collection and Governance of Corpus in the Field of Power Security. This step is the foundation for building a high-quality model. First, a wide range of professional corpus on power system cybersecurity is collected to form the original corpus. Its main sources include: 1) Technical standards and protocol specifications, such as IEC 61850, IEC 60870-5-104, DNP3, and other core protocol texts for power industrial control systems; 2) Vulnerability and threat intelligence, filtering vulnerability descriptions, risk analyses, and solutions related to power equipment from vulnerability databases such as CVE / NVD and CNVD; 3) Attack knowledge base, integrating MITRE, ATT&CK, ICS frameworks, historical security event analysis reports from the power industry, and malware analysis records; 4) Security protection regulations, incorporating national and industry-issued security protection regulations and guidelines for power monitoring systems. Subsequently, the original corpus undergoes data governance, including: data cleaning (removing irrelevant characters and duplicates), format standardization (unifying to structured formats such as JSON or XML), privacy anonymization (anonymizing IP addresses, hostnames, and organization names), and the construction of a dedicated power security dictionary to improve the accuracy of subsequent word segmentation. The final output is a high-quality, compliant power safety corpus that has been cleaned, standardized, and de-identified.

[0084] Step 102: Domain Knowledge Injection Based on Power System Corpus. This step aims to deeply integrate power security knowledge into the model parameters. A general pre-trained large language model is selected as the foundation. Subsequently, the improved power security corpus described above is used to further pre-train this foundational model. During this process, self-supervised learning objectives such as masked language modeling are employed to enable the model to learn and master the professional terminology, protocol command semantics, typical attack patterns, and security strategies of the power system.

[0085] Step 103: Instruction Fine-tuning for Power Security Analysis Tasks. After the model acquires domain knowledge, this step aims to teach it how to use that knowledge to perform specific security analysis tasks. First, a high-quality instruction dataset is constructed, designed for typical power system threat scenarios, containing a "instruction-input-expected output" triple. For example: Instruction: "Analyze the following network traffic sequence to determine if there are any signs of a DDoS attack targeting the power control system (such as SCADA)." Input: "Within 2 minutes, over 100,000 different IPs continuously send TCP SYN requests to port 502 (Modbus TCP) of the substation control server, resulting in a slow server response." Expected Output: "High confidence alert: Suspected protocol-based DDoS attack (TCP SYN Flood). This behavior aims to exhaust the communication resources of the control system and may affect real-time power monitoring. Recommendation: Initiate traffic scrubbing and check the firewall's blocking policy for abnormal source IPs." Then, using efficient parameter fine-tuning techniques, this instruction dataset is used for supervised fine-tuning of the model. This process can significantly reduce computational costs while accurately stimulating the domain knowledge learned by the model during the pre-training stage, enabling it to learn to follow human instructions and generate outputs that conform to the logic and format specifications of power safety analysis.

[0086] Step 104: Model Validation and Evaluation. After fine-tuning the instructions, the model performance needs to be rigorously validated. The model should be evaluated using a test set independent of the training set, containing various power system threat scenarios. Evaluation metrics include not only threat detection accuracy and recall, but also, and more importantly, the reasonableness and interpretability of its output. Only models that can stably and accurately identify threats and provide clear reasoning processes and remediation suggestions are considered qualified domain-adaptive security models and permitted for deployment in subsequent threat detection processes.

[0087] Step 2: Acquisition and context preprocessing of multi-source security data of the power system.

[0088] Step 201: Multi-source Heterogeneous Data Acquisition and Aggregation. Through acquisition probes and agents deployed in different partitions of the power network, full-volume security data is collected in real-time or offline. Data sources include: 1) Information Networks (IT), including office network traffic, server access logs, etc.; 2) Industrial Control Networks (OT), focusing on collecting communication traffic from key facilities such as SCADA systems, power generation control units, and distribution automation terminals, especially communication messages based on industrial control protocols such as IEC 61850, DNP3, and Modbus; 3) Security Facilities, collecting security alarms and operation logs from firewalls, intrusion detection systems, and security audit platforms; 4) Terminal Devices, collecting security events from engineer workstations, operator workstations, smart meters, and mobile maintenance terminals; 5) External Intelligence, accessing the latest vulnerability announcements, threat indicators, and attack group intelligence covering the power industry. All data is aggregated through a unified data bus, providing raw materials for subsequent processing.

[0089] Step 202: Contextual Data Governance and Enhancement for Power Business. Deep governance is performed on the aggregated raw data to build a context that the model can understand. First, protocol parsing and standardization are performed, using a dedicated parsing engine to deeply decode industrial control protocols and extract key fields such as function codes and operation values. Next, execution time synchronization and alignment are performed, unifying the timestamps of logs from different sources to a standard time. A crucial step is business context enhancement, which associates IP addresses with their respective power functional zones through the asset management system and tags operational behaviors with business semantics. Finally, privacy and sensitive information are de-identified, with personnel accounts and specific parameter values ​​masked or hashed to ensure compliance.

[0090] Step 203: Constructing Natural Language Descriptions. To achieve optimal understanding of the large model, the managed structured data is transformed into natural language descriptions rich in business semantics. The system uses predefined templates and rules to combine discrete log entries into coherent narratives. For example, a raw login failure event {src_ip: '10.1.1.100', user:'admin', dst_host: 'scada-svr', time: '2024-11-09 10:00:00', result: 'failure'} will be transformed into: "Time: 2024-11-09 10:00:00; Source: IP address 10.1.1.100 (Engineer Station A); Destination: SCADA server; Event: User 'admin' attempted login; Status: Failed." This format provides high-quality input with clear business context for the large model.

[0091] Step 3: Multi-dimensional analysis and reasoning of power threats based on a large security model.

[0092] Step 301: Lateral Contextual Analysis. The model analyzes the propagation patterns of suspicious behavior among different nodes in the power network within the same time window. When the model detects signs of a terminal being compromised, it immediately searches and analyzes whether that terminal attempted to communicate or log in to other critical assets within the network (such as SCADA servers, power metering systems, and generation control units) within a short period of time. By identifying this "stepping stone"-based lateral movement pattern, the model can promptly detect the attacker's penetration and spread behavior within the power intranet and outline potential infection paths.

[0093] Step 302: Vertical Contextual Correlation Analysis. The model dynamically compares the currently observed events with the historical normal behavior baselines of target entities such as users, hosts, and terminals. For example, if an operations and maintenance account that typically only logs into the system and performs specific queries during weekday office hours suddenly initiates access to high-risk commands such as modifying protection settings or remotely controlling circuit breakers late at night during non-working hours, the model will combine its historical behavior patterns to determine that this operation is a serious anomaly, possibly indicating credential theft or internal threats, and thus issue a high-priority alarm.

[0094] Step 303: External Intelligence Correlation and Attack Chain Reconstruction. The model performs real-time matching and verification of suspicious indicators such as malicious IPs, virus hashes, and abnormal domain names generated from internal analysis with access to external threat intelligence databases to confirm their malice and the threat organization to which they belong. Furthermore, the model can intelligently connect multiple discrete security events using its learned attack knowledge to reconstruct a complete "attack chain" that conforms to attack logic. For example: phishing email delivery -> malicious script execution on engineer workstation -> internal network port scanning -> successful login to SCADA server -> abnormal database query. Based on this, the model assesses the ultimate potential impact of this attack chain on the operation of the power system, such as whether it may lead to unplanned generator outages, partial power outages in the distribution network, or serious accidents such as monitoring data tampering, thus providing crucial evidence for risk assessment.

[0095] Step four explains threat report generation and automated response.

[0096] Step 401: Generate a structured, interpretable threat report. The model output is no longer a simple binary judgment, but a clearly structured and well-supported natural language analysis report. The report must include the following core elements: 1) Threat determination, clearly indicating the specific threat type, such as "lateral movement in the early stages of a ransomware attack"; 2) Confidence level, showing the degree of confidence in the model's judgment as a percentage; 3) Correlation evidence, clearly listing key log entries, behavioral patterns, or traffic characteristics that support the judgment; 4) Attack intent reasoning, deeply analyzing the attacker's ultimate goal, such as "This series of actions aims to gain control of the SCADA system and may be intended to launch a large-scale blackout attack"; 5) Remediation recommendations, providing specific and actionable initial mitigation measures, such as "It is recommended to immediately isolate the infected host on the network and verify the integrity of the backup data."

[0097] Step 402: Integration with the Power Safety Operation and Maintenance System. Deep integration with the power company's existing safety operation and maintenance platform is achieved through standardized APIs. Based on the threat report's level and content, the system can automatically or manually execute response actions. For example: automatically adding rules to the industrial control firewall to block malicious IP access; remotely isolating confirmed compromised smart meters through the terminal management platform; issuing warning messages to dispatching personnel, prompting them to review specific control commands; or triggering a pre-set "data leakage" handling script on the SOAR platform, coordinating multiple security devices for a collaborative response. The reward model is used to evaluate the model's output quality and generate reinforcement signals.

[0098] Step 5: Continuously optimize the model based on feedback.

[0099] Step 501: Feedback Data Collection and Labeling. In daily security operations, the system records all interactions between security analysts and the model output. When an analyst confirms an alert as a real threat, corrects a model's erroneous judgment (e.g., marking a false alarm as "benign"), or supplements information not mentioned by the model, these operations, along with their corresponding raw data, model output, and the final correct conclusion, are automatically collected and stored in the feedback database. This process essentially involves digitally labeling the knowledge of human experts.

[0100] Step 502: Incremental Training and Model Iteration. The system periodically uses accumulated feedback data to incrementally train the deployed domain-adaptive security model. The training process typically employs efficient parameter fine-tuning techniques to "feed" the model with new knowledge from human experts at a low cost. For example, when a new attack pattern targeting distributed photovoltaic inverters is first discovered and confirmed by experts, the model can learn the characteristics of this pattern through incremental training, enabling accurate identification in the event of similar attacks in the future.

[0101] Step 503: Model Performance Evaluation and Deployment. Each new model version generated after incremental training undergoes rigorous performance evaluation on an independent test set containing known threat scenarios. Only when it is confirmed that its accuracy, recall, and other key metrics are no lower than the original version, and no new serious biases are introduced, will the new model be approved for deployment, updating the existing production environment through smooth replacement or parallel operation. Thus, the system forms a closed loop of "detection -> feedback -> learning -> optimization -> re-detection," ultimately achieving continuous evolution of the model, making it increasingly intelligent with use in the specific security environment of the power system.

[0102] The network security threat detection system based on a domain-adaptive security big model described in this invention includes the following core modules:

[0103] (1) Data Acquisition and Preprocessing Module: This module is responsible for collecting multi-source heterogeneous raw security data from network devices, security devices, servers, terminals, and external threat intelligence sources. Its function is to clean, denoise, standardize, and extract features from this data, and to convert structured log entries into natural language descriptions to facilitate the understanding and processing of subsequent large models.

[0104] (2) Domain Adaptive Security Model Core Engine Module: This module is the intelligent hub of the system, carrying a security model trained in two stages. The first stage is further pre-training to enhance domain knowledge, using a massive cybersecurity corpus to train the general model and enable it to master professional domain knowledge. The second stage is fine-tuning of instructions for security analysis tasks, using a carefully constructed instruction dataset to optimize the model and enable it to perform specific security analysis tasks. This module receives preprocessed data and performs deep reasoning and contextual analysis.

[0105] (3) Model Management and Update Module: This module is responsible for version control, online deployment, and lifecycle management of the security model. It integrates a feedback learning loop, which can collect the correction opinions of security analysts on the model output, and use this feedback data to perform regular incremental learning and optimization of the model, so that the system has the ability to continuously evolve.

[0106] (4) Detection Result Output and Response Module: This module receives the structured analysis results output by the core engine module and generates an easy-to-understand threat report. At the same time, it can be integrated with the existing security operation and maintenance system to automatically or semi-automatically trigger alarms, block traffic, isolate hosts and other response actions according to preset policies.

[0107] Taking an attacker's complete attack chain—using spear-phishing emails to infiltrate a power system and ultimately attempt to steal historical data from the power business system—as an example, the effectiveness of this method is illustrated. Phishing email attacks generally consist of three stages: initial penetration, lateral movement, and privilege escalation and data theft.

[0108] In the initial penetration phase, attackers send elaborately forged phishing emails to employees on the internal network. When an employee clicks the attachment, a malicious script executes on an office terminal. Traditional methods might generate an isolated alert about suspicious script execution, but due to a lack of context, this alert is easily buried among a sea of ​​low-priority alerts. However, the model trained using this method can identify this anomalous behavior from terminal logs and immediately mark it as an "initial access attempt." Through semantic analysis of the script's characteristics, the model determines that it is highly similar to known phishing attack patterns, generates an alert with a 75% confidence level, and begins tracking the terminal's subsequent behavior.

[0109] During the lateral movement phase, attackers use compromised terminals on the internal network as springboards to begin scanning and probing the network boundary. Traditional methods may generate dozens of port scan alerts from security devices, but it's difficult to distinguish between normal maintenance and malicious activity. However, the model trained using this method can correlate scanning behavior with previous initial access events. Combined with the characteristic that the scan targets are all internal network business systems, it determines the activity as a "lateral movement attempt," increasing the confidence level to 88%. The system automatically marks the terminal as "compromised" and upgrades its monitoring level.

[0110] During the privilege escalation and data theft phase, attackers use stolen VPN credentials to log into the internal network system from the compromised terminal and begin batch querying the system's historical database. Traditional methods might only detect these actions as normal authorized behaviors when examining the VPN login and database queries, rendering detection methods completely ineffective. However, the model trained using this method can detect anomalies through multi-dimensional correlation analysis: the account logs in outside of working hours, the login source is a tagged compromised host, and the query pattern is unusually frequent. The model generates a 98% confidence "data theft attack" alert as soon as the attacker begins data theft and automatically triggers the response process, successfully blocking the attack before data leakage.

[0111] The above solution enhances the detection capability for complex threats: Based on a large-scale model-based semantic understanding and reasoning mechanism, it identifies attack patterns that are difficult to detect using traditional methods, such as multi-stage attacks and low-frequency, slow attacks. Through sequence pattern recognition and attack chain semantic analysis, it can discover complex attacks that traditional feature-matching or statistical anomaly detection methods cannot identify. It reduces the false alarm rate: By using contextual correlation analysis technology, it establishes behavioral baselines for devices, users, and business operations, and combines multi-source data cross-validation to effectively distinguish between normal business operations and malicious behavior. Compared to traditional single-point detection methods, it reduces false alarms caused by factors such as peak business periods and network topology changes. It achieves fully automated analysis: It constructs an automated pipeline from data collection and threat analysis to response and handling, integrating with existing security devices through standardized interfaces to achieve full lifecycle management of security incidents. The system supports automated judgment and handling suggestion generation, significantly reducing manual intervention. It provides interpretable detection results: Employing a structured report output mechanism, each threat determination is accompanied by a related evidence chain, behavioral analysis basis, and threat rating explanation. This mechanism allows security personnel to trace the model's decision-making process, verify the judgment logic, and improve the credibility of the analysis results. Supports continuous optimization and evolution: A reinforcement learning mechanism based on human feedback is established, allowing security experts to annotate and correct the model output, forming an incremental training dataset. The system supports online learning and hot model updates, enabling it to adapt to new attack methods and changes in the business environment, maintaining the timeliness of detection capabilities.

Claims

1. A network security threat detection method based on a domain-adaptive security big model, characterized in that: Includes the following steps: Step 1: Construct a domain-adaptive security model for power system threats, including: Step 101: Systematic collection and management of corpora in the field of power safety: First, a wide range of professional corpora related to power system cybersecurity were collected to form the original corpus. The sources of these corpora included: 1) technical standards and protocol specifications; 2) vulnerability and threat intelligence, which included vulnerability descriptions, risk analyses, and solutions related to power equipment, selected from CVE / NVD and CNVD vulnerability databases; 3) attack knowledge bases, integrating MITRE, ATT&CK, ICS frameworks, historical security incident analysis reports from the power industry, and malware analysis records; and 4) security protection regulations, incorporating national and industry-issued security protection regulations and guidelines for power monitoring systems. Subsequently, data governance was carried out on the original corpus, including data cleaning, format standardization, and privacy desensitization. A dedicated dictionary for power safety was also built to improve the accuracy of subsequent word segmentation. Finally, a high-quality and compliant power safety corpus that has been cleaned, standardized, and desensitized was output. Step 102: Domain knowledge injection based on power corpus: A general pre-trained large language model is selected as the basis. Then, the power security corpus obtained in step 101 is used to continue pre-training the basic model. In this process, a self-supervised learning objective is adopted to enable the model to learn and master the professional terminology, protocol command semantics, typical attack patterns and security strategies of the power system. Step 103: Fine-tuning of instructions for power security analysis tasks: First, a high-quality instruction dataset is constructed, which targets typical threat scenarios in power systems and contains "instruction-input-expected output" triples. Then, a parameter-efficient fine-tuning method is used to supervise the fine-tuning of the model using this instruction dataset; Step 104: Model Validation and Evaluation The model is evaluated using a test set that is independent of the training set and includes various power system threat scenarios. The evaluation metrics include not only the accuracy and recall of threat detection, but also the rationality and interpretability of its output results. Step 2: Acquisition and context preprocessing of multi-source security data of the power system; Step 3: Multi-dimensional analysis and reasoning of power threats based on a large security model; Step four allows for the interpretation of threat report generation and automated response; Step 5: Continuously optimize the model based on feedback.

2. The network security threat detection method based on a domain-adaptive security big model according to claim 1, characterized in that: In step 101, the technical standards and protocol specifications include IEC 61850, IEC 60870-5-104 and DNP3.

3. The network security threat detection method based on a domain-adaptive security big model according to claim 1 or 2, characterized in that: Step two, the acquisition and context preprocessing of multi-source security data of the power system, includes: Step 201: Multi-source heterogeneous data acquisition and aggregation: By deploying acquisition probes and agents in different partitions of the power network, a full range of security data is collected in real time or offline. The data sources include: 1) Information networks, including office network traffic and server access logs; 2) Industrial control networks, collecting communication traffic from SCADA systems, power generation control units, and distribution automation terminals, especially communication messages based on IEC 61850, DNP3, and Modbus industrial control protocols; 3) Security facilities, collecting security alarms and operation logs from firewalls, intrusion detection systems, and security audit platforms; 4) Terminal devices, collecting security events from engineer workstations, operator workstations, smart meters, and mobile maintenance terminals; and 5) External intelligence, accessing the latest vulnerability announcements, threat indicators, and attack group intelligence covering the power industry. All data is aggregated through a unified data bus to obtain the aggregated raw data. Step 202: Contextual Data Governance and Enhancement for Electricity Business: The aggregated raw data undergoes in-depth governance to construct a model-understandable context. First, protocol parsing and standardization are performed, using a dedicated parsing engine to deeply decode industrial control protocols and extract key fields such as function codes and operation values. Next, execution time synchronization and alignment are implemented, unifying the timestamps of logs from different sources to a standard time. A crucial step is business context enhancement, which associates IP addresses with their respective power functional zones through the asset management system and labels operational behaviors with business semantics. Finally, privacy and sensitive information are de-identified by masking or hashing personnel accounts and specific parameter values ​​to ensure compliance. Step 203: Constructing Natural Language Descriptions: To achieve optimal understanding of large models, the system transforms the managed structured data into natural language descriptions rich in business semantics. It uses predefined templates and rules to combine discrete log entries into coherent narratives.

4. The network security threat detection method based on a domain-adaptive security big model according to claim 1 or 2, characterized in that: Step three involves multi-dimensional analysis and reasoning of power threats based on a large-scale security model, including: Step 301: Lateral Contextual Analysis: The model analyzes the propagation patterns of suspicious behavior among different nodes in the power network within the same time window. When the model detects signs of a terminal being compromised, it immediately searches and analyzes whether the terminal attempted to communicate or log in to other critical assets in the network within a short period of time. By identifying this lateral movement pattern based on "stepping stones," the model can promptly detect the attacker's penetration and spread behavior in the power intranet and outline potential infection paths. Step 302: Vertical contextual correlation analysis: The model dynamically compares the currently observed events with the historical normal behavior baselines of users, hosts, and terminal target entities. If an anomaly is found, a warning is issued. Step 303: External Intelligence Correlation and Attack Chain Reconstruction: The model performs real-time matching and verification between suspicious indicators generated by internal analysis and access to external threat intelligence databases to confirm their malice and the threat organization to which they belong. In addition, the model uses its learned attack knowledge to intelligently connect multiple discrete security events to reconstruct a complete "attack chain" that conforms to attack logic. Based on this, the model will assess the ultimate potential impact of this attack chain on the operation of the power system, thereby providing key evidence for risk assessment.

5. In step four, the generation of threat reports and automated responses can be explained, including: Step 401: Generate a structured and interpretable threat report: The model outputs a well-structured and well-supported natural language analysis report, which must include the following core elements: 1) Threat determination, clearly indicating the specific threat type; 2) Confidence level, showing the degree of confidence of the model's judgment as a percentage; 3) Correlation evidence, clearly listing key log entries, behavioral patterns, or traffic characteristics that support the judgment in a list format. 4) Attack intent reasoning: In-depth analysis of the attacker's ultimate goal; 5) Handling recommendations: Providing specific and actionable initial mitigation measures; Step 402: Integration with the Power Safety Operation and Maintenance System: Through standardized APIs, the system is deeply integrated with the power company's existing safety operation and maintenance platform. Based on the level and content of the threat report, the system automatically or manually confirms and executes response actions; remotely isolates confirmed compromised smart meters through the terminal management platform; issues early warning information to dispatching and operation personnel, prompting them to review specific control commands; or triggers a preset "data leakage" handling script on the SOAR platform, coordinating multiple security devices to respond collaboratively; and uses the reward model to evaluate the quality of the model output and generate reinforcement signals.

6. The network security threat detection method based on a domain-adaptive security big model according to claim 1 or 2, characterized in that: In step five, the model is continuously optimized based on feedback, including: Step 501: Feedback Data Collection and Labeling: In the daily use of security operations and maintenance, the system will record all interactive operations of security analysts on the model output. When an analyst confirms that an alarm is a real threat, corrects the model's wrong judgment, or supplements the judgment information not mentioned by the model, these operations, along with their corresponding raw data, model output and final correct conclusion, will be automatically collected and stored in the feedback database. Step 502: Incremental Training and Model Iteration: The system periodically uses accumulated feedback data to incrementally train the deployed domain-adaptive security big model. The training process adopts a parameter-efficient fine-tuning method to "feed" the model with new knowledge from human experts in a low-cost manner. Step 503: Model Performance Evaluation and Deployment: Each new model version generated after incremental training will undergo rigorous performance evaluation on an independent test set containing known threat scenarios. Only when it is confirmed that the new model is no less than the original version in key metrics and does not introduce new serious biases will the new model be approved for deployment to update the existing production environment in a smooth replacement or parallel operation manner.

7. A network security threat detection system based on a domain-adaptive security big model, characterized in that: include: Data Acquisition and Preprocessing Module: This module is responsible for collecting multi-source heterogeneous raw security data from network devices, security devices, servers, terminals, and external threat intelligence sources. It then cleans, denoises, standardizes, and extracts features from this data, converting structured log entries into natural language descriptions to facilitate understanding and processing by subsequent large-scale models. The collected multi-source heterogeneous raw security data includes: 1) technical standards and protocol specifications; 2) vulnerability and threat intelligence, filtering vulnerability descriptions, risk analyses, and solutions related to power equipment from CVE / NVD and CNVD vulnerability databases; 3) attack knowledge base, integrating MITRE, ATT&CK, ICS frameworks, historical security event analysis reports from the power industry, and malware analysis records; and 4) security protection regulations, incorporating national and industry-issued security protection regulations and guidelines for power monitoring systems. Domain Adaptive Security Model Core Engine Module: This module is the intelligent hub of the system, carrying a security model trained in two stages. The first stage is further pre-training with domain knowledge enhancement, using massive cybersecurity corpora to train the general model and enable it to master professional domain knowledge. The second stage is instruction fine-tuning for security analysis tasks, using a constructed instruction dataset to optimize the model, enabling it to perform specific security analysis tasks. This module receives preprocessed data and performs deep reasoning and contextual analysis. Instruction fine-tuning for security analysis tasks includes: constructing a high-quality instruction dataset targeting typical threat scenarios in power systems, containing "instruction-input-expected output" triples; and then using an efficient parameter fine-tuning method, using this instruction dataset for supervised fine-tuning of the model. Detection Result Output and Response Module: This module receives the structured analysis results output by the core engine module and generates an easy-to-understand threat report; at the same time, it integrates with the security operation and maintenance system to automatically or semi-automatically trigger response actions according to preset policies; Model Management and Update Module: This module is responsible for version control, online deployment, and lifecycle management of the large security model. It integrates a feedback learning loop, which can collect feedback from security analysts on the model output and use this feedback data to perform regular incremental learning and optimization of the model, enabling the system to have continuous evolution capabilities.

8. The network security threat detection system based on a domain-adaptive security big model according to claim 7, characterized in that: The core engine module of the domain-adaptive security big data model receives preprocessed data and performs deep inference and contextual analysis, including: A. Acquisition and context preprocessing of multi-source security data in power systems: Multi-source heterogeneous data acquisition and aggregation: Through acquisition probes and agents deployed in different partitions of the power network, full-volume security data is collected in real-time or offline. Data sources include: 1) Information networks, including office network traffic and server access logs; 2) Industrial control networks, collecting communication traffic from SCADA systems, power generation control units, and distribution automation terminals, especially communication messages based on IEC 61850, DNP3, and Modbus industrial control protocols; 3) Security facilities, collecting security alarms and operation logs from firewalls, intrusion detection systems, and security audit platforms; 4) Terminal devices, collecting security events from engineer workstations, operator workstations, smart meters, and mobile maintenance terminals; 5) External intelligence, accessing the latest vulnerability announcements, threat indicators, and attack group intelligence covering the power industry. All data is aggregated through a unified data bus to obtain the aggregated raw data. Contextual Data Governance and Enhancement for Power Business: Deep governance of aggregated raw data is performed to construct a model-understandable context. First, protocol parsing and standardization are conducted, using a dedicated parsing engine to deeply decode industrial control protocols and extract key fields such as function codes and operation values. Next, execution time synchronization and alignment are performed, unifying timestamps from logs from different sources to a standard time. A crucial step is business context enhancement, which associates IP addresses with their respective power functional zones through the asset management system and labels operational behaviors with business semantics. Finally, privacy and sensitive information are de-identified, with personnel accounts and specific parameter values ​​masked or hashed to ensure compliance. Natural Language Description Construction: To achieve optimal understanding of large models, the system transforms the managed structured data into natural language descriptions rich in business semantics. The system uses predefined templates and rules to combine discrete log entries into a coherent narrative. B. Multi-dimensional analysis and reasoning of power threats based on a large-scale security model: Lateral contextual analysis: The model analyzes the propagation patterns of suspicious behavior among different nodes in the power network within the same time window. When the model identifies signs of a terminal being compromised, it immediately searches and analyzes whether the terminal attempted to communicate or log in to other critical assets in the network within a short period of time. By identifying this lateral movement pattern based on "stepping stones", the model can promptly detect the attacker's penetration and spread behavior in the power intranet and outline potential infection paths. Vertical contextual correlation analysis: The model dynamically compares the currently observed events with the historical normal behavior baselines of users, hosts, and terminal target entities. If an anomaly is found, a warning is issued. External intelligence correlation and attack chain reconstruction: The model performs real-time matching and verification of suspicious indicators generated by internal analysis with access to external threat intelligence databases to confirm their malice and the threat organization to which they belong; in addition, the model uses its learned attack knowledge to intelligently connect multiple discrete security events to reconstruct a complete "attack chain" that conforms to the attack logic; based on this, the model will assess the ultimate potential impact of this attack chain on the operation of the power system, thereby providing key evidence for risk assessment.

9. The network security threat detection system based on a domain-adaptive security big model according to claim 7 or 8, characterized in that: The detection results output and response module reports the following: 1) Threat determination, clearly indicating the specific threat type; 2) Confidence level, showing the degree of confidence of the model's judgment as a percentage; 3) Correlation evidence, clearly listing the key log entries, behavioral patterns, or traffic characteristics that support the judgment in a list format. 4) Attack intent reasoning: In-depth analysis of the attacker's ultimate goal; 5) Handling recommendations: Providing specific and actionable initial mitigation measures; Integration with security operations and maintenance systems: Through standardized APIs, the system deeply integrates with the power company's existing security operations and maintenance platform. Based on the level and content of threat reports, the system automatically or manually confirms and executes response actions. It remotely isolates confirmed compromised smart meters through the terminal management platform; issues early warning information to dispatching and operation personnel, prompting them to review specific control commands; or triggers a preset "data leakage" handling script on the SOAR platform, coordinating multiple security devices to respond collaboratively; and uses the reward model to evaluate the quality of model output and generate reinforcement signals.

10. The network security threat detection system based on a domain-adaptive security big model according to claim 7 or 8, characterized in that: The model management and update module collects feedback from security analysts on the model's output and uses this feedback data to perform regular incremental learning and optimization of the model, including: Feedback data collection and annotation: In the daily use of security operations and maintenance, the system will record all interactive operations of security analysts on the model output. When an analyst confirms that an alarm is a real threat, corrects the model's wrong judgment, or supplements the judgment information not mentioned by the model, these operations, along with their corresponding raw data, model output and final correct conclusion, will be automatically collected and stored in the feedback database. Incremental training and model iteration: The system periodically uses accumulated feedback data to incrementally train the deployed domain-adaptive security model. The training process adopts a parameter-efficient fine-tuning method to "feed" the model with new knowledge from human experts in a low-cost manner. Model performance evaluation and deployment: Each new model version generated after incremental training will undergo rigorous performance evaluation on an independent test set containing known threat scenarios. Only when it is confirmed that the new model is no less than the original version in key metrics and does not introduce new serious biases will the new model be approved for deployment to update the existing production environment in a smooth replacement or parallel operation manner.

Images