Early warning information triple information extraction method based on large model and storage device

Abstract

The invention provides an early warning information triple information extraction method based on a large model and a storage device, and is applied to the technical field of network information processing, the method optimizes network early warning information triple extraction capability through 'P-tuning + Prompt Tuning' double fine tuning, constructs a full link for early warning information collection and filtering, standardization processing and data storage visualization, and improves the efficiency of early warning information collection and filtering, standardization processing and data storage visualization. The network early warning information extraction speed and accuracy can be greatly improved, manual auditing time consumption is remarkably reduced, an early warning event responsibility subject is assisted to quickly receive accurate early warning information so as to start emergency response, and network early warning is further promoted to be upgraded from passive receiving to active pre-judgment.

Description

Technical Field

[0001] This application relates to the field of network information processing technology, specifically to a method for extracting early warning information triplet information based on a large model. Background Technology

[0002] With the rapid development of LLM (Large Language Model) models, many cybersecurity information processing tasks that rely on traditional deep learning models have been simplified. Previously, information processing in the field of cybersecurity (such as security incident classification, generative summarization of security reports, and dialogue response to security issues) required large-scale, high-quality data. The rise of LLM models has brought about a revolution in this field. In the cybersecurity information extraction stage, the two existing traditional solutions have significant shortcomings:

[0003] (1) CRF+LSTM annotation model: A large amount of network security text data (such as vulnerability reports and attack event descriptions) needs to be manually annotated to extract the security event triple (security event type, affected assets, and responsible party). The initial annotation work is difficult, costly, and has a high threshold for implementation.

[0004] (2) FastText binary classification + rule-based extraction pipeline solution: First, FastText is used to distinguish whether the text is related to network security, and then rule-based extraction is performed on the security-related text. However, the pipeline mode has a low fault tolerance rate. The classification error in the previous stage (such as misjudging the security warning as ordinary news) will be directly passed to the subsequent extraction stage, which will seriously affect the accuracy of the final result.

[0005] The aforementioned deficiencies in existing technologies have become a pressing technical problem that needs to be solved in the field of network information security. Summary of the Invention

[0006] To address the aforementioned problems in existing technologies, this application proposes a method and storage device for extracting network early warning information triplets based on a large language model. By optimizing the network early warning information triplet extraction capability through "P-tuning + Prompt Tuning" dual fine-tuning, a complete chain of early warning information collection, filtering, standardization processing, and data storage visualization is constructed. This significantly improves the speed and accuracy of network early warning information extraction, substantially reduces the time spent on manual review, helps responsible parties of early warning events quickly receive accurate early warning information to initiate emergency response, and further promotes the upgrade of network early warning from passive reception to proactive prediction.

[0007] The technical solution adopted in this application is as follows:

[0008] In a first aspect, embodiments of this application provide a method for extracting early warning information triplet information based on a large model, the method comprising:

[0009] Obtain security information from data sources, and then filter and screen that information.

[0010] The large model is fine-tuned a second time. The prompt statements and network warning information to be processed are input into the fine-tuned large model for standardization, and the triplet information is output.

[0011] Data storage and visualization management of triplet information.

[0012] In some embodiments of this application, the large model is ChatGLM4-9B.

[0013] In some embodiments of this application, the secondary fine-tuning includes a first fine-tuning and a second fine-tuning; the first fine-tuning is continuous prompting fine-tuning (P-tuning), which optimizes the input layer and captures key information of the basic large model; the second fine-tuning is continuous prompting fine-tuning (Prompt Tuning) based on the first fine-tuning, which introduces task-specific prompts to enhance prompt understanding.

[0014] In some embodiments of this application, the first fine-tuning includes:

[0015] Define a dedicated prompt template for the warning scenario;

[0016] Modify the input layer of the large model by introducing a long short-term memory network module to capture key information in the network warning information text; add learnable continuous cue embeddings to the embedding layer of the large model;

[0017] With the goal of minimizing the task loss of network early warning information triplet extraction, the parameters of continuous prompt embedding are dynamically updated through backpropagation to train and optimize the process.

[0018] After training and optimization, the optimized continuous prompts are embedded and directly combined with the network warning information text to be processed. After being input into the large model, the prediction results of the network warning information triplet are generated.

[0019] In some embodiments of this application, the dedicated prompt template includes input network warning information text, output triplet, and continuous prompt embedded placeholders.

[0020] In some embodiments of this application, the output triplet includes the warning event type, the scope of impact, and the responsible party.

[0021] In some embodiments of this application, the second fine-tuning includes:

[0022] A dedicated prompt word node for early warning tasks is introduced. After the prompt words are converted into vectors, they are fused with the network early warning information text vectors that have undergone the first fine-tuning in front of the FFN module.

[0023] The model is trained, and the parameters are optimized based on the interaction between the prompt word vectors and the intermediate features of the model, so that the large model can learn the correspondence between the prompt words for the early warning task and the text vectors of the network early warning information.

[0024] In some embodiments of this application, the screening and filtering of security information in step S101 above includes: using RocketMQ to collect data from the data source, first filtering the information obtained from the data source through a domain name whitelist to remove irrelevant data; filtering ordinary news based on a preset network warning keyword dictionary, and finally retaining the network security warning information to be processed.

[0025] In some embodiments of this application, the key information includes time series information and contextual long dependencies.

[0026] Secondly, embodiments of this application also provide a storage device including: a memory and a processor, the processor including multiple cores, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the method described above.

[0027] The following technical effects can be achieved through the embodiments of this application:

[0028] (1) By using the “P-tuning+Prompt Tuning” dual fine-tuning mode, the security information triplet can be accurately extracted with only a small amount of labeled data, which greatly reduces the dependence on data labeling and the cost of implementation.

[0029] (2) By fine-tuning the model, we can directly focus on the task of network security information extraction. With the output "format filter", we can automatically correct missing fields and format errors, avoid error transmission between links, and significantly improve the extraction accuracy.

[0030] (3) By designing the entire chain of “collection and filtering - standardized processing - storage and visualization”, the security information processing cycle is further shortened and the time spent on manual review is reduced. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating the application method;

[0033] Figure 2 This is a schematic diagram illustrating the principle of secondary fine-tuning;

[0034] Figure 3 This is a flowchart illustrating the first minor adjustment.

[0035] Figure 4 This is a flowchart illustrating the second fine-tuning process;

[0036] Figure 5 This is a schematic diagram of the structure of a storage device. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] Before describing the technical solution of this application, the technical terms used in the technical solution are explained as follows:

[0039] Large Language Model (LLM): The core technical paradigm in the current field of Natural Language Processing (NLP), which is essentially a general-purpose model for understanding, generating, reasoning about, and even applying human language through "large-scale parameters + massive text data + deep learning architecture".

[0040] Prompt Tuning is a highly efficient technique for fine-tuning large model parameters. Its core principle is to adapt the model to a specific task by adjusting a small number of parameters while retaining the general capabilities of the pre-trained model. Learnable, continuous prompt vectors are introduced into the model's input layer. These vectors are trained as task-specific parameters, while the core parameters of the pre-trained model remain fixed. It is suitable for multi-task scenarios, requiring optimization of only a small number of prompt parameters per task, resulting in low resource consumption and excellent performance on tasks with few samples.

[0041] P-tuning is an improvement over Prompt Tuning. It uses encoders such as LSTM to convert discrete cues into continuous embeddings, which are then used in model training to enhance the ability to capture textual context (such as long dependencies and temporal information). Compared to Prompt Tuning, it is more suitable for handling complex semantic understanding tasks (such as information extraction) and can improve the accuracy and stability of cues.

[0042] Embedding layer: The "first step" in Transformer's text processing. It transforms the original text into a vector form that the model can process through numerical transformation and semantic encoding. At the same time, it combines positional encoding to provide sequence order information, laying the foundation for subsequent attention mechanisms and feature extraction.

[0043] ChatGLM4-9B: A culmination of Transformer architecture in Chinese scenarios, multimodal interaction, and lightweight deployment. It inherits the core advantages of Transformer (such as self-attention mechanism and layered stacking structure), while breaking through the performance bottlenecks and application boundaries of traditional Transformer through architectural optimization, tool integration, and domain fine-tuning.

[0044] Figure 1 The following is a flowchart illustrating the application method, which includes the following steps:

[0045] Step S101: Obtain security information from the data source and filter and screen the security information;

[0046] Step S102: Perform secondary fine-tuning on the large model. Input the prompt statement and the network warning information to be processed into the fine-tuned large model for standardization processing, and output triplet information.

[0047] Step S103: Store and visualize the triplet information.

[0048] In step S101 above, the data source includes obtaining the domain name of a legitimate domestic network early warning information release platform, such as an enterprise security early warning announcement platform, a cloud service provider's security early warning center, or a security vendor's vulnerability notification platform.

[0049] In step S101 above, the screening and filtering of security information includes:

[0050] RocketMQ is used to collect data from data sources. First, information obtained from the data sources is filtered by domain whitelist to remove irrelevant data. Based on a preset network warning keyword dictionary, ordinary news (such as security product promotions and irrelevant technical discussions) is filtered out. Finally, network security warning information to be processed is retained, such as "SQL injection", "vulnerability disclosure", "abnormal access", "malicious attack", "virus intrusion", etc.

[0051] In step S102 above, the large model is ChatGLM4-9B;

[0052] The secondary fine-tuning includes a first fine-tuning and a second fine-tuning; the first fine-tuning is continuous prompting fine-tuning (P-tuning), which optimizes the input layer and captures key information of the basic large model; the second fine-tuning is continuous prompting fine-tuning (Prompt Tuning) based on the first fine-tuning, which introduces task-specific prompt words to enhance prompt understanding.

[0053] Figure 2 This is a schematic diagram illustrating the principle of the second fine-tuning. As shown in the diagram, the first fine-tuning focuses on enhancing input layer features. In the diagram, this involves combining Input Embedding and Prompt Token, then proceeding through the stages of MH-Attention (multi-head attention mechanism) and Add&Norm (residual connections and layer normalization). Input Embedding converts the text into vectors, MH-Attention initially fuses continuous prompts with text vector features, and Add&Norm provides a stable training process, avoiding gradient explosion.

[0054] The initial P-tuning is achieved through lightweight input layer modifications and continuous cue embedding optimizations. This initial fine-tuning includes the following steps: Figure 3 As shown:

[0055] Step S301: Define a dedicated prompt template for the early warning scenario;

[0056] The dedicated prompt template includes input network warning information text, output triplet, and continuous prompt embedded placeholders;

[0057] The output triple includes the type of early warning event, the scope of impact, and the responsible party.

[0058] In the above steps, the target is clearly extracted by defining a special prompt template for the early warning scenario, so as to avoid the random interference of discrete prompts.

[0059] Step S302: Modify the input layer of the large model by introducing a long short-term memory network module to capture key information in the network warning information text; add learnable continuous prompts to the embedding layer of the large model.

[0060] The key information includes time-series information and long-term contextual dependencies;

[0061] In the above steps, only the input layer of the large model is modified without affecting the core parameters of the large model. The Long Short-Term Memory (LSTM) network module is integrated to capture two types of key information in the security text: time-series information, such as the time of warning occurrence and the duration of vulnerability existence; and long-term contextual dependencies, such as the correlation between vulnerability type and scope of impact, and the correspondence with responsible parties. By adding learnable continuous cue embeddings to the embedding layer of the large model, and associating the hidden state of the model through a mapping function, the compatibility between continuous cue and security text vector is ensured.

[0062] Step S303: With the goal of minimizing the task loss of network early warning information triplet extraction, the parameters of continuous prompt embedding are dynamically updated through backpropagation to train and optimize the parameters.

[0063] In the above steps, only the processing result of the first-layer Transformer on the input prefix (continuous prompts + network warning information text vector) is calculated, without involving the deep Transformer layer, which reduces the computational cost and allows the model to accurately learn the security text features.

[0064] Step S304: After training and optimization are completed, the optimized continuous prompts are embedded and directly combined with the network early warning information text to be processed. After inputting into the large model, the prediction results of the network early warning information triplet are generated.

[0065] In the above steps, after training is completed, directly combining the optimized continuous prompt embedding with the network security text tags to be processed can ensure extraction stability.

[0066] In the first fine-tuning described above, an LSTM module is used to capture long-term dependencies and temporal information, and a continuous cue embedding layer replaces discrete cue with a learnable vector representation. The goal of this first fine-tuning is to enable the model to quickly adapt to the text features of network warning scenarios, achieving accurate extraction of warning event triples (warning event type, scope of impact, and responsible party) without large-scale data training. It also addresses the instability problem caused by the randomness of discrete cue extraction in a lightweight (only modifying the input layer) and efficient (without affecting the deep Transformer layers) manner.

[0067] The first fine-tuning is a core step preceding the entire two fine-tuning process. After the network warning information text is converted into a vector through Input Embedding, it is initially combined with the prompt token sequence Prompt Token1-Prompt Token n, and then processed sequentially by the MH-Attention and Add&Norm modules. During this process, the first fine-tuning (P-tuning) is completed simultaneously, which also lays the foundation for the warning text features for the subsequent second fine-tuning (Prompt Tuning).

[0068] like Figure 2 As shown, the second fine-tuning focuses on enhancing task adaptability. The diagram covers the stages after the first fine-tuning, flowing through the FFN (Feedforward Neural Network), Add&Norm modules, and up to the Linear layer. The second fine-tuning, Prompt Tuning, is achieved through "introducing task-specific prompts + enhancing prompt comprehension," aiming to reduce task adaptation costs. The second fine-tuning includes the following steps: Figure 4 As shown:

[0069] Step S401: Introduce a dedicated prompt word node for the early warning task. After converting the prompt word into a vector, perform a secondary fusion with the network early warning information text vector that has undergone the first fine-tuning in front of the FFN module.

[0070] In the above steps, an additional "early warning task-specific prompt word" input node is added. This prompt word is used for network early warning information triple extraction. After the prompt word is converted into a vector, it is fused with the "text + continuous prompt" vector, which has undergone the first fine-tuning process, before the FFN module. This clearly informs the model that the current task is network early warning information triple extraction, avoiding task ambiguity.

[0071] Step S402: Train the model and optimize the parameters based on the interaction between the prompt word vector and the intermediate features of the model, so that the large model can learn the correspondence between the prompt words for the early warning task and the text vector of the network early warning information.

[0072] In the above steps, it is not necessary to modify the core parameters of the large model. Only the parameters are optimized for the interaction between the prompt word vector and the intermediate features of the model. The large model learns the correspondence between the prompt words for the early warning task and the text vector of the network early warning information. When it recognizes the "triple extraction" prompt words, it prioritizes keywords such as the type of early warning event, the scope of impact, and the responsible party in the text.

[0073] After the second fine-tuning is completed, if a similar warning task needs to be changed, such as from "triple extraction" to "vulnerability type extraction", only the "task-specific prompt words" need to be modified. There is no need to carry out a full fine-tuning again, so as to achieve quick adaptation of prompt words.

[0074] The aforementioned second fine-tuning is part of the subsequent task adaptation phase of the entire fine-tuning process. After the initial extraction of security text features through the first fine-tuning (P-tuning), the model enters the feedforward neural network (FFN) and Add&Norm modules to further process the features. During this process, task-specific prompt word nodes are incorporated to complete the Prompt Tuning fine-tuning, ensuring that the model focuses on the specific task of extracting network warning information triples.

[0075] In the implementation process of the second fine-tuning mentioned above, the task objective is clarified by a task-specific prompt word input node, the prompt word vector representation is strengthened by the prompt token sequence Prompt Token1-PromptTokenn, the prompt word vector and text features are fused by a feedforward neural network FFN, and the feature distribution after the second fusion is stabilized by Add&Norm.

[0076] The two fine-tuning steps described above enhance the model's ability to understand the prompts for specific tasks extracted from the network early warning triplet, allowing the model to quickly adapt to similar security tasks simply by adjusting the prompts. This reduces task adjustment costs (eliminating the need for retraining) and improves task focus (avoiding interference from irrelevant features), while simultaneously achieving synergistic optimization of feature extraction and task adaptation.

[0077] This application, based on the open-source LLM large-scale model and combined with the needs of network early warning information, improves and optimizes the prompt statements to allow the large-scale model to directly extract triples (early warning event type, scope of impact, and responsible party) from the early warning text. Relying on the large-scale model's massive early warning knowledge base for training, it directly generates standardized triple results in JSON format for easy subsequent data processing. The following example illustrates the prompt statements and extracted triples after the two fine-tuning steps. The optimized prompt statements are as follows:

[0078] You are a professional cybersecurity information analyst, and you are now required to organize and process early warning information related to cybersecurity incidents (such as vulnerability reports, attack descriptions, and abnormal access alerts). Specific requirements are as follows:

[0079] 1. Extract three types of information from the text: "Type of Warning Event," "Scope of Impact," and "Responsible Entity."

[0080] - Warning event type: The specific event attributes must be clearly defined. For example, "SQL injection attack" cannot be abbreviated to "injection", and "user data leakage vulnerability" cannot be abbreviated to "data vulnerability".

[0081] - Scope of impact: The identifier of the affected object must be retained, and the supplementary description in parentheses must be removed (e.g., "Cloud Server ECS (Enterprise Edition)" should be simplified to "Cloud Server ECS");

[0082] -Responsible Entity: refers to the organization responsible for the affected party (such as a corporate department or service provider). If the name contains parentheses such as "(Branch)" or "(Department)", only the core information before the parentheses should be retained (e.g., "Shenzhen E-commerce Platform (Security Department)" should be simplified to "Shenzhen E-commerce Platform").

[0083] 2. If there are multiple types of early warning events for the same object, they should be listed separately on a "one event, one record" basis; if there are multiple types of affected objects under the same responsible entity, they should be extracted separately.

[0084] 3. The output format is a JSON array, with each array element corresponding to a security event record. The field names are fixed as "warning event type", "scope of impact" and "responsible entity".

[0085] Enter the network warning message text:

[0086] "A technology company in Beijing has been frequently attacked by SQL injection attacks in the past two days; a user login system of an e-commerce platform in Shenzhen has been found to have vulnerabilities, which has led to the risk of leakage of some users' login credentials. At the same time, the platform's payment gateway has been accessed abnormally."

[0087] The expected output should be as follows: [

[0089] {

[0090] "Warning Event Type": "SQL Injection Attack"

[0091] "Scope of impact": "Elastic Compute Service (ECS)"

[0092] Responsible Entity: "A technology company in Beijing"

[0093] },

[0094] {

[0095] "Warning Event Type": "User Login Credential Leakage Vulnerability",

[0096] "Scope of impact": "User login system",

[0097] Responsible Entity: "A certain e-commerce platform in Shenzhen"

[0098] },

[0099] {

[0100] "Warning Event Type": "Abnormal Access to Payment Gateway",

[0101] Scope of impact: "Payment gateways"

[0102] Responsible Entity: "A certain e-commerce platform in Shenzhen"

[0103] } ]

[0105] Please organize and extract the following network warning information text, and output it strictly according to the above requirements:

[0106] "This section contains the text information of a cybersecurity incident pending processing."

[0107] The above-mentioned fine-tuned prompts are divided into three parts, all of which have undergone multiple rounds of testing and iteration to adapt to network early warning requirements:

[0108] Task localization layer: Define the model role (network early warning information analyst) and core objective (determine whether the text is related to an early warning event and extract triples);

[0109] Rule definition layer: Refine the extraction criteria for the three types of information (format and content simplification rules) to avoid vague expressions;

[0110] Example guiding layer: Provides complete "input-output" examples, offering feature references for the model and reducing extraction errors.

[0111] Call the fine-tuned large model, input "prompt statement + network warning text to be processed", and standardize the model output to form JSON data containing 12 fields, defined as follows:

[0112]

[0113]

[0114] In one implementation, considering that the model cannot output results that conform to the preset format 100%, a format filtering step is added at the output end to correct results with missing fields (such as omission of the responsible party) and format errors (such as JSON syntax errors), and the corrected data is pushed to the database to ensure the compliance of the information entering the database.

[0115] In step S103 above, data storage includes two parts: one part stores the triplet information output after fine-tuning the large model, and the other part stores the corresponding original network early warning information before standardization, including basic information such as platform name, link, and release time, for data backtracking during network fluctuations (if the data push platform fails, it can be re-uploaded from the backup database); subsequent early warning trend analysis (such as statistics on the occurrence rate of early warning events in a certain region / type). Taking the network security field as an example, the tables stored in the backup database are as follows:

[0116]

[0117] In step S103 above, visual management is implemented through a data platform. The data platform provides early warning response personnel with a one-stop "query-verify-modify" operation, supporting quick information retrieval using keywords such as "impact range," "early warning event type," and "responsible entity." It also provides functions such as impact range management, early warning event type management, responsible entity management, regional management, early warning event knowledge graph, tag management (risk level tags / target object type tags), data query, batch upload / download, and system settings.

[0118] To further improve the accuracy of network early warning information extraction and the efficiency of emergency response, a network early warning knowledge base (such as network security vulnerability databases, attack event case databases, and emergency response solution databases from vendors in the network security field, such as Qi An Xin, Venustech, and Sangfor) can be introduced to achieve intelligent matching of "early warning events - knowledge base".

[0119] Precise matching logic: Based on the "scope of impact" and "type of warning event", the system searches the knowledge base to quickly obtain historical warning event records, common causes and standardized handling solutions for this type of warning event;

[0120] Related information storage: For target objects with similar scope of influence under the responsible entity (such as an enterprise), such as equipment of the same model or cross-departmental related assets, the warning event records are automatically linked and stored in the data platform to form a "object-event-responsible entity" association network;

[0121] Value of intelligent upgrade: Through knowledge base matching, it can not only provide real-time early warning event investigation basis for early warning personnel (shortening emergency response time), but also form a multi-dimensional relationship such as "affected target object - historical early warning event - handling plan" in the data platform, promoting the upgrade of network early warning from "passive reception" to "proactive prediction".

[0122] It should be understood that although the steps in the flowcharts in the accompanying drawings are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts in the accompanying drawings may include multiple steps or stages, which are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0123] It is understood that the same / similar parts between the various embodiments of the methods described above in this specification can be referred to each other. Each embodiment focuses on the differences from other embodiments, and relevant parts can be referred to the description of other method embodiments.

[0124] According to embodiments of this application, this application also provides a storage device. Figure 5 This is a schematic diagram of the structure of a storage device provided in an embodiment of this application, such as... Figure 5As shown, the storage device 500 may include a processor 501 and a memory 502. The memory 502 stores a computer program 503. When the computer program 503 is executed by the processor 501, it can implement the method provided in any of the above embodiments. Its execution mode and beneficial effects are similar and will not be described again here.

[0125] Of course, for the sake of simplicity, Figure 5 Only some of the components of the storage device relevant to this application are shown in this illustration; components such as buses, input / output interfaces, input devices, and output devices are omitted. In addition, the storage device may include any other suitable components depending on the specific application.

[0126] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.

[0127] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for extracting early warning information triplet information based on a large model, characterized in that, The method includes: Obtain security information from data sources, and then filter and screen that information. The large model is fine-tuned a second time. The prompt statements and network warning information to be processed are input into the fine-tuned large model for standardization, and the triplet information is output. Data storage and visualization management of triplet information.

2. The method according to claim 1, characterized in that, The large model is ChatGLM4-9B.

3. The method according to claim 1 or 2, characterized in that, The secondary fine-tuning includes a first fine-tuning and a second fine-tuning; the first fine-tuning is continuous prompting fine-tuning (P-tuning), which optimizes the input layer and captures key information of the basic large model through the first fine-tuning. The second fine-tuning is a continuous prompting fine-tuning based on the first fine-tuning. The second fine-tuning introduces task-specific prompts to enhance the understanding of the prompts.

4. The method according to claim 3, characterized in that, The first fine-tuning includes: Define a dedicated prompt template for the warning scenario; Modify the input layer of the large model by introducing a long short-term memory network module to capture key information in the network warning information text; add learnable continuous cue embeddings to the embedding layer of the large model; With the goal of minimizing the task loss of network early warning information triplet extraction, the parameters of continuous prompt embedding are dynamically updated through backpropagation to train and optimize the process. After training and optimization, the optimized continuous prompts are embedded and directly combined with the network warning information text to be processed. After being input into the large model, the prediction results of the network warning information triplet are generated.

5. The method according to claim 4, characterized in that, The dedicated prompt template includes input network warning information text, output triplet, and continuous prompt embedded placeholders.

6. The method according to claim 4, characterized in that, The output triple includes the type of early warning event, the scope of impact, and the responsible party.

7. The method according to claim 3, characterized in that, The second fine-tuning includes: A dedicated prompt word node for early warning tasks is introduced. After the prompt words are converted into vectors, they are fused with the network early warning information text vectors that have undergone the first fine-tuning in front of the FFN module. The model is trained, and the parameters are optimized based on the interaction between the prompt word vectors and the intermediate features of the model, so that the large model can learn the correspondence between the prompt words for the early warning task and the text vectors of the network early warning information.

8. The method according to claim 1, characterized in that, In step S101 above, the screening and filtering of security information includes: using RocketMQ to collect data from data sources, first filtering the information obtained from the data sources through a domain whitelist to remove irrelevant data; filtering ordinary news based on a preset network warning keyword dictionary, and finally retaining the network security warning information to be processed.

9. The method according to claim 4, characterized in that, The key information includes time series information and long-term contextual dependencies.

10. A storage device, characterized in that, include: A memory and a processor, the processor including multiple cores, wherein the memory stores a computer program that, when executed by the processor, implements the method as described in any one of claims 1 to 9.

Images