Vulnerability number identification method and system based on multi-model collaboration and semantic understanding

Abstract

The invention discloses a vulnerability number identification method and system based on multi-model collaboration and semantic understanding, and the method comprises the steps: carrying out the analysis and normalization processing of original network flow, and extracting a multi-dimensional feature vector; inputting the feature vectors into a plurality of malicious detection models in parallel, and obtaining a classification result and confidence of each model; carrying out fusion according to a multi-model decision rule to generate a joint judgment result; for the traffic judged to be malicious or suspicious, extracting complete request load data of the traffic and inputting the complete request load data into the security big language model optimized in the network security field; the model directly outputs a standard vulnerability number after carrying out deep semantic analysis on a load based on a preset cue word template; through combination of multi-model collaborative preliminary screening and semantic deep research and judgment, efficient processing of mass flow and accurate and automatic numbering identification of vulnerabilities are realized, the problems that in the prior art, detection efficiency and depth are difficult to consider at the same time, and the false alarm and missing report rate is high are solved, and the intelligent level of security defense is remarkably improved.

Description

Technical Field

[0001] This invention belongs to the intersection of cybersecurity and artificial intelligence, and in particular relates to a vulnerability number identification method and system based on multi-model collaboration and semantic understanding. Background Technology

[0002] In the field of cybersecurity, accurately identifying attack behaviors from massive amounts of network traffic and associating them with specific vulnerability IDs is crucial for achieving efficient early warning and response. Existing technical solutions suffer from several limitations: while rule-based matching or traditional feature libraries offer fast processing speeds, they heavily rely on prior knowledge, resulting in poor adaptability to unknown attacks and variant vulnerabilities, leading to high false negative rates; solutions using single, complex deep learning models improve detection accuracy, but the sheer size of these models limits their inference speed to meet real-time requirements, creating an inherent contradiction between efficiency and depth; and simple multi-model integration solutions, while using multiple models in parallel, lack refined collaborative decision-making mechanisms and functional divisions, resulting in severe model homogenization and limited performance improvement. Furthermore, existing solutions generally face the bottleneck of scarce high-quality labeled data, and their final output often remains at the level of malicious behavior identification, failing to achieve precise attribution at the vulnerability ID level. These problems collectively constrain further improvements in the automation and intelligence of cybersecurity defense systems. Summary of the Invention

[0003] Purpose of the invention: The purpose of this invention is to provide a vulnerability number identification method based on multi-model collaboration and semantic understanding, which has high detection efficiency, high identification accuracy, and can automatically output vulnerability numbers; on the other hand, it provides a vulnerability number identification method system based on multi-model collaboration and semantic understanding.

[0004] Technical solution: The vulnerability number identification method based on multi-model collaboration and semantic understanding described in this invention includes the following:

[0005] Receive raw network traffic, perform protocol parsing and normalization on the raw network traffic, and extract its multi-dimensional feature vector;

[0006] The multidimensional feature vectors are input in parallel into two or more malicious detection models, and the classification results and corresponding confidence scores of each model are obtained.

[0007] Based on the preset multi-model decision rules, all the classification results and confidence levels are fused to generate a joint judgment result for the current traffic, which includes normal, malicious or suspicious.

[0008] For traffic that is determined to be malicious or suspicious by the joint judgment, extract its complete request payload data;

[0009] The request payload data is input into the security big language model; the security big language model is a big language model optimized by network security instruction corpus and adaptive simulation vulnerability corpus;

[0010] The standard vulnerability number is directly output by the security language model after performing deep semantic parsing on the request payload data based on a preset prompt word template.

[0011] Preferably, the multi-model decision rule is:

[0012] If all the classification results output by the malicious detection models are normal, then the joint judgment result is normal;

[0013] If all the malicious detection models output a classification result of malicious, then the joint determination result is malicious.

[0014] If at least one of the malicious detection models outputs a classification result of malicious, or if the confidence level of the malicious category output by at least one of the malicious detection models is higher than a preset numerical threshold, then the joint determination result is suspicious.

[0015] Preferably, the lightweight malicious detection model is a neural network model, the structure of which includes:

[0016] The system consists of a character embedding layer for extracting character-level features from the input text; a BaseBERT module for extracting token-level semantic features from the input text; a feature concatenation layer for concatenating the character-level features with the token-level semantic features; a multi-layer Transformer encoder for encoding the concatenated features to capture long-range dependencies; and a classification and discrimination structure consisting of a one-dimensional convolutional layer, a global pooling layer, and a fully connected layer, which outputs the classification results and confidence scores.

[0017] Preferably, the optimization process of the security large language model includes: an instruction fine-tuning step and a reinforcement learning fine-tuning step; the instruction fine-tuning step includes using instruction corpus in the field of network security to perform full-parameter instruction following fine-tuning on the base large language model; the reinforcement learning fine-tuning step includes using adaptive simulation vulnerability corpus and, based on reinforcement learning algorithm, fine-tuning the model after instruction fine-tuning.

[0018] Preferably, the adaptive simulation vulnerability corpus is constructed by a method including the following steps:

[0019] Based on the OWASP Top 10 vulnerability types and CVE vulnerability descriptions, generate prompt words;

[0020] Using a generative large language model, an initial simulation load is generated based on the generative prompt words;

[0021] The initial simulation payload was evaluated for vulnerability recall using the current version of the security big language model.

[0022] If the evaluation result is that the correct vulnerability cannot be recalled, the instruction is to generate a payload variant that is based on the same principle but is easier to identify using the generative large language model described above.

[0023] If the evaluation result indicates that the correct vulnerability has been successfully recalled, the instruction will be to use the generative large language model to generate payload variants that are based on the same principle but are more difficult to identify.

[0024] The initial simulation load, more easily identifiable load variants, and more difficult-to-identify load variants are mixed to form the adaptive simulation vulnerability corpus.

[0025] Preferably, the malicious detection model is trained through an active learning process, which includes:

[0026] First initialization phase: The security big language model performs preliminary automatic annotation on the unlabeled network traffic data, and after verification, forms the first batch of high-quality labeled corpus, which is used to train the first version of the malicious detection model;

[0027] Subsequent iteration phase: The trained malicious detection model is used to automatically label new unlabeled traffic data, which is then reviewed again to expand the labeled corpus, and the expanded corpus is used to update the model;

[0028] The model performance is optimized by executing the subsequent iteration phase multiple times.

[0029] Preferably, the preset prompt word template includes at least instruction words, vulnerability database background information, and output format requirements.

[0030] A vulnerability number identification system based on multi-model collaboration and semantic understanding, comprising:

[0031] The preprocessing module receives raw network traffic and performs protocol parsing and normalization to extract multi-dimensional feature vectors.

[0032] A rapid initial screening module includes: at least two malicious detection units for parallel processing of the multidimensional feature vectors and outputting classification results and confidence scores; and a decision fusion unit for fusing the classification results and confidence scores according to multi-model decision rules and outputting a joint judgment result.

[0033] The deep analysis module is used to extract complete request payload data for traffic that is determined to be malicious or suspicious by the joint judgment.

[0034] The vulnerability number output module is used to combine the request payload data with the prompt word template, input it into the security big language model, and receive the standard vulnerability number directly output by it; the security big language model is a big language model optimized by network security domain instruction corpus and adaptive simulation vulnerability corpus.

[0035] Preferably, the multi-model decision rule applied by the decision fusion unit is:

[0036] If all the classification results output by the malicious detection units are normal, then the joint judgment result is normal;

[0037] If all the classification results output by the malicious detection units are malicious, then the joint judgment result is malicious;

[0038] If at least one of the malicious detection units outputs a classification result of malicious, or if the confidence level of the malicious category output by at least one of the malicious detection units is higher than a preset numerical threshold, then the joint determination result is suspicious.

[0039] Preferably, it also includes a model training module for performing instruction fine-tuning and reinforcement learning fine-tuning of the secure large language model and executing the active learning process to train the malicious detection model.

[0040] Beneficial Effects: Compared with existing technologies, this invention has the following significant advantages: By constructing a two-stage mechanism that combines parallel initial screening by multiple malicious detection models with in-depth analysis by a large security language model, this invention effectively solves the core contradiction of balancing detection efficiency and in-depth analysis capabilities. This mechanism achieves a unified approach of real-time, rapid screening of massive network traffic with precise, numbered, in-depth analysis of a small number of high-risk traffic. Combined with adaptive simulation corpus generation and active learning iteration processes, a self-optimizing intelligent analysis process is formed, automatically solving the problem of scarce high-quality labeled data in model training, continuously optimizing model performance, and significantly improving the accurate identification of unknown advanced threats and complex vulnerabilities. Ultimately, this invention achieves automated, high-precision, numbered (e.g., CVE numbered) identification of security vulnerabilities, improving the automation and response efficiency of vulnerability discovery, and solving the problems of high false positive and false negative rates and insufficient attribution capabilities caused by the single capabilities of existing models and lack of deep semantic understanding. This fundamentally enhances the intelligence, proactivity, and accuracy of the network security defense system. Attached Figure Description

[0041] Figure 1 This is a schematic flowchart of the method of the present invention;

[0042] Figure 2 This is a diagram illustrating the algorithm framework of the malicious detection model of this invention.

[0043] Figure 3 This is a schematic diagram illustrating the iterative construction process of the malicious detection model based on active learning in this invention;

[0044] Figure 4 This is a schematic diagram illustrating the construction process of the adaptive simulation corpus of this invention. Detailed Implementation

[0045] The following is in conjunction with the appendix Figure 1-4 The technical solution of the present invention will be further described below.

[0046] Example 1:

[0047] This embodiment provides a complete implementation process for a vulnerability number identification method based on multi-model collaboration and semantic understanding. This embodiment is implemented on a server equipped with an Intel Xeon Platinum 8360Y CPU and an NVIDIA A100 PCIe 80GB GPU, running Ubuntu 20.04 LTS. The software development environment is Python 3.9, primarily utilizing libraries such as PyTorch 2.0, Transformers, and Scikit-learn for model building and training.

[0048] Step 1: Traffic reception, parsing and multidimensional feature vector extraction: Receive raw network traffic, perform protocol parsing and normalization on the raw network traffic, and extract its multidimensional feature vector.

[0049] First, the system receives raw network traffic via a network interface, specifically captured HTTP / HTTPS network packets. Then, the Scapy library is used to parse the packets, reconstructing a structured HTTP request object. Next, the parsed request is normalized to eliminate data heterogeneity. This includes converting the entire URL path to lowercase; URL decoding the query string or parameter values ​​in the request body; and standardizing all field names in the request header to a standard case format (e.g., capitalizing the first letter). Finally, a multi-dimensional feature vector is extracted from the normalized request. This vector consists of features in the following three dimensions:

[0050] URL structure information: Extract the hierarchical structure of the URL path, file extensions, etc., and convert them to One-Hot encoding;

[0051] Request parameter sequence: Concatenates all parameter names and values ​​in the GET / POST request into a single text string sequence in the order they appear.

[0052] Key request header fields: Filter out request header fields that have a critical impact on security detection, such as User-Agent, Content-Type, and Accept, and represent them as standardized strings.

[0053] Step 2: Rapid initial screening based on multi-model parallel detection and decision fusion: Input multi-dimensional feature vectors in parallel into two or more malicious detection models, and obtain the classification results and corresponding confidence scores of each model; according to the preset multi-model decision rules, fuse all classification results and confidence scores to generate a joint judgment result for the current traffic.

[0054] The multidimensional feature vectors obtained in step 1 are input in parallel into three malicious detection models (denoted as Model_A, Model_B, and Model_C) with the same structure but slightly different initialization and training data. Each malicious detection model performs analysis independently and outputs its classification result (one of the three categories defined in this embodiment: "normal", "malicious", or "suspicious") and the corresponding confidence score (a probability value between 0 and 1). Each malicious detection model is a meticulously designed neural network employing a multi-scale, multi-level feature fusion algorithm framework. Its structure includes: a character embedding layer (Embedding Dimension=128) for fine-grained character-level feature extraction of text features such as URLs and parameter sequences; a BaseBERT module (e.g., bert-base-uncased, output layer dimension 768) for extracting deep semantic features at the token level; a feature concatenation layer (concatenating the character-level feature vectors with the token-level semantic feature vectors to achieve multi-scale feature fusion); a multi-layer Transformer encoder (inputting the concatenated features into a 4-layer Transformer encoder (HiddenSize=512, Attention Heads=8) for deep encoding of the fused features to capture multi-level long-range semantic dependencies in the request); and a classification and discrimination structure (passing the output of the Transformer encoder through a one-dimensional convolutional layer (Kernel Size=3, ...). The system consists of Filters=256, a global max pooling layer, and a fully connected layer (with an output dimension of 3, corresponding to the normal, malicious, and suspicious categories, respectively). Finally, the classification results and confidence scores are output through the Softmax function.

[0055] After obtaining the outputs of all models, the decision fusion unit makes a final decision based on the following multi-model decision rules: if Model_A, Model_B, and Model_C are all judged as "normal", the joint decision result is normal; if all three are judged as "malicious", the joint decision result is malicious; if at least one model is judged as "malicious", or the confidence level of the "malicious" category output by at least one model is higher than a preset numerical threshold (in this embodiment, the threshold is set to 0.7), the joint decision result is suspicious.

[0056] Step 3: Deep Semantic Analysis and Vulnerability Number Generation Based on the Security Big Language Model: For traffic whose joint judgment result is malicious or suspicious, extract its complete request payload data; input the request payload data into the security big language model; the security big language model is a big language model optimized by network security domain instruction corpus and adaptive simulation vulnerability corpus; after the security big language model performs deep semantic analysis on the request payload data based on the preset prompt word template, it directly outputs the standard vulnerability number.

[0057] For traffic initially identified as "malicious" or "suspicious" in step 2, the system extracts its complete request payload data (Request Body / Payload); the payload is then combined with a pre-defined, optimized prompt template to form a complete prompt. This template must include at least three elements: instruction words, vulnerability database background information, and output format requirements. A specific template example is: "You are a network security analysis expert. Based on the following HTTP request payload, analyze the security vulnerability it is attempting to exploit. Please only output the most relevant CVE number; if no matching vulnerability is found, output 'None'. Payload: [Enter the specific payload data here]".

[0058] The combined complete prompt is input into the secure large language model. In this embodiment, the model uses CodeLlama-13B as the base model and has undergone two phases of dedicated optimization:

[0059] Instruction fine-tuning: Using approximately 500,000 cybersecurity instruction data (such as "Please analyze whether the following payload has security vulnerabilities"), the base language model is fine-tuned with full parameters to enable it to follow security analysis instructions.

[0060] Reinforcement learning fine-tuning: The adaptive simulation vulnerability corpus generated in step 4 below is used to fine-tune the model using reinforcement learning based on the near-end policy optimization (PPO) algorithm, so as to further improve the accuracy and robustness of its judgment.

[0061] This security big language model performs deep semantic parsing and contextual reasoning on the input prompts, and then directly outputs a corresponding standard vulnerability number, such as "CVE-2021-41773".

[0062] Step 4: Construction of an adaptive simulation vulnerability corpus for training a large security model.

[0063] Based on the OWASP Top 10 vulnerability list (such as "injection vulnerabilities") and specific CVE descriptions (such as the detailed description of CVE-2021-41773), generative prompts are constructed, for example: "Generate an HTTP request payload for exploiting the Apache HTTP Server path traversal vulnerability (CVE-2021-41773)". Using GPT-4 as a generative large language model, a large number of initial simulated payload corpora are generated based on the above prompts. The generated initial payloads are then input into the current version of the security large language model for vulnerability recall assessment.

[0064] If the model fails to recall the correct CVE number, the payload is marked as "hard" and GPT-4 is instructed to generate a payload variant that is based on the same principle but is more easily identifiable by reducing obfuscation and using a more direct attack syntax.

[0065] If the model successfully identifies the payload, it marks the payload as "simple" and instructs GPT-4 to generate a payload variant that is based on the same principle but is more difficult to identify by adding advanced obfuscation, inserting irrelevant parameters, or using equivalent function replacements.

[0066] The original generated simulated payload, more easily identifiable payload variants, and more difficult-to-identify payload variants are mixed in a 1:1:1 ratio to form a high-quality adaptive simulated vulnerability corpus with uniform difficulty distribution, which is used for RLHF training of the security big language.

[0067] Step 5: Iterative training of the malicious detection model based on the active learning process.

[0068] This active learning process comprises two distinct phases:

[0069] The first initialization phase involves the security language model, after initial training, performing preliminary automatic labeling on a large amount of unlabeled traffic to generate labels such as "normal," "malicious," or "suspicious." Cybersecurity experts (penetration and attack experts) then manually review and correct the automatic labeling results based on the CWE (Common Vulnerability Enumeration) standard to ensure labeling quality and form the first batch of high-quality labeled corpus. This corpus is then used to train the first version of the malicious detection model (e.g., Model_Av1).

[0070] Subsequent iterations: The trained malicious detection model (Model_A v1) is used to automatically label new unlabeled traffic data; the labeled corpus is expanded by expert review; the model is retrained with the expanded corpus to obtain the more powerful Model_A v2.

[0071] By performing the above subsequent iterations multiple times (e.g., 3 to 5 times), the corpus size is continuously expanded and the model performance is optimized until the model's metrics (such as F1-Score) on the validation set tend to stabilize, thus obtaining the final version of the malicious detection model.

[0072] To verify the technical effectiveness of this invention, experiments were conducted on a self-constructed test set containing 70,000 normal requests and 10,000 malicious requests. The results show that the scheme in this embodiment achieves an optimal balance between efficiency and depth: the average processing time for each request in the rapid initial screening stage of step 2 is less than 10 milliseconds, which can meet the real-time screening requirements for massive traffic; while the overall vulnerability number identification accuracy reaches 96.7%, achieving accurate, number-level in-depth analysis of high-risk traffic.

[0073] This method significantly improves the accuracy and generalization ability of vulnerability identification. This is mainly due to the multi-scale (character-level and token-level) and multi-level (multi-layer Transformer) feature fusion structure adopted by the malware detection model, which enables it to more comprehensively capture the subtle features of attack payloads. Combined with multi-model decision rules, it effectively reduces false positives and false negatives. More importantly, through the deep semantic analysis capabilities of the security big language model, this solution can understand the vulnerability principles behind unknown attack methods, thereby achieving the direct output of new and variant attacks and their corresponding CVE numbers. Its generalization ability far exceeds that of rule-based and traditional machine learning methods.

[0074] Furthermore, this invention constructs a self-evolving, high-quality model training system. Through an active learning iterative framework (model annotation - expert review - model iteration) and adaptive simulation corpus generation technology (dynamically generating training samples of varying difficulty), a virtuous cycle of "model optimization - data augmentation" is formed, automatically alleviating the deep learning model's dependence on high-quality labeled data, and enabling the model performance to continuously evolve and improve in practice.

[0075] Ultimately, this solution significantly enhances the automation and intelligence of security analysis. It elevates the final output from the traditional binary "malicious / normal" judgment to a precise vulnerability identifier (such as CVE-2021-41773), providing security operations personnel with direct and actionable security threat intelligence, greatly shortening incident response time, and reducing over-reliance on the experience of senior security experts.

[0076] Example 2:

[0077] This embodiment provides a vulnerability number identification system based on multi-model collaboration and semantic understanding. It includes a preprocessing module for receiving raw network traffic and performing protocol parsing and normalization to extract multi-dimensional feature vectors; a rapid initial screening module comprising at least two malicious detection units for parallel processing of multi-dimensional feature vectors and outputting classification results and confidence levels; a decision fusion unit for fusing the classification results and confidence levels according to multi-model decision rules and outputting a joint judgment result; a deep analysis module for extracting complete request payload data for traffic whose joint judgment result is malicious or suspicious; a vulnerability number output module for combining request payload data with prompt word templates and inputting them into a security large language model, receiving its directly output standard vulnerability number; the security large language model is a large language model optimized using network security domain instruction corpora and adaptive simulation vulnerability corpora; and a model training module for performing instruction fine-tuning and reinforcement learning fine-tuning of the security large language model and executing an active learning process to train the malicious detection model.

[0078] The multi-model decision rule applied by the decision fusion unit is as follows: if the classification results output by all malicious detection units are normal, the joint judgment result is normal; if the classification results output by all malicious detection units are malicious, the joint judgment result is malicious; if at least one malicious detection unit outputs a classification result that is malicious, or if the confidence level of the malicious category output by at least one malicious detection unit is higher than a preset numerical threshold, the joint judgment result is suspicious.

Claims

1. A vulnerability number identification method based on multi-model collaboration and semantic understanding, characterized in that, Includes the following: Receive raw network traffic, perform protocol parsing and normalization on the raw network traffic, and extract its multi-dimensional feature vector; The multidimensional feature vectors are input in parallel into two or more malicious detection models, and the classification results and corresponding confidence scores of each model are obtained. Based on the preset multi-model decision rules, all the classification results and confidence levels are fused to generate a joint judgment result for the current traffic, which includes normal, malicious or suspicious. For traffic that is determined to be malicious or suspicious by the joint judgment, extract its complete request payload data; The request payload data is input into the security big language model; the security big language model is a big language model optimized by network security instruction corpus and adaptive simulation vulnerability corpus; The standard vulnerability number is directly output by the security language model after performing deep semantic parsing on the request payload data based on a preset prompt word template.

2. The vulnerability number identification method according to claim 1, characterized in that, The multi-model decision rule is as follows: If all the classification results output by the malicious detection models are normal, then the joint judgment result is normal; If all the malicious detection models output a classification result of malicious, then the joint determination result is malicious. If at least one of the malicious detection models outputs a classification result of malicious, or if the confidence level of the malicious category output by at least one of the malicious detection models is higher than a preset numerical threshold, then the joint determination result is suspicious.

3. The vulnerability number identification method according to claim 1, characterized in that, The lightweight malware detection model is a neural network model, and its structure includes: The character embedding layer is used to extract character-level features from the input text; the BaseBERT module is used to extract token-level semantic features from the input text; and the feature concatenation layer is used to concatenate the character-level features with the token-level semantic features. A multi-layer Transformer encoder is used to encode the concatenated features to capture long-range dependencies; The classification and discrimination structure consists of a one-dimensional convolutional layer, a global pooling layer, and a fully connected layer, which are used to output the classification results and confidence scores.

4. The vulnerability number identification method according to claim 1, characterized in that, The optimization process of the security large language model includes: an instruction fine-tuning step and a reinforcement learning fine-tuning step; the instruction fine-tuning step includes using instruction corpus in the field of network security to perform full-parameter instruction following fine-tuning on the base large language model; the reinforcement learning fine-tuning step includes using adaptive simulation vulnerability corpus and, based on reinforcement learning algorithm, fine-tuning the model after instruction fine-tuning.

5. The vulnerability number identification method according to claim 4, characterized in that, The adaptive simulation vulnerability corpus is constructed using a method comprising the following steps: Based on the OWASP Top 10 vulnerability types and CVE vulnerability descriptions, generate prompt words; Using a generative large language model, an initial simulation load is generated based on the generative prompt words; The initial simulation payload was evaluated for vulnerability recall using the current version of the security big language model. If the evaluation result is that the correct vulnerability cannot be recalled, the instruction is to generate a payload variant that is based on the same principle but is easier to identify using the generative large language model described above. If the evaluation result indicates that the correct vulnerability has been successfully recalled, the instruction will be to use the generative large language model to generate payload variants that are based on the same principle but are more difficult to identify. The initial simulation load, more easily identifiable load variants, and more difficult-to-identify load variants are mixed to form the adaptive simulation vulnerability corpus.

6. The vulnerability number identification method according to claim 1, characterized in that, The malicious detection model is trained through an active learning process, which includes: First initialization phase: The security big language model performs preliminary automatic annotation on the unlabeled network traffic data, and after verification, forms the first batch of high-quality labeled corpus, which is used to train the first version of the malicious detection model; Subsequent iteration phase: The trained malicious detection model is used to automatically label new unlabeled traffic data, which is then reviewed again to expand the labeled corpus, and the expanded corpus is used to update the model; The model performance is optimized by executing the subsequent iteration phase multiple times.

7. The vulnerability number identification method according to claim 1, characterized in that, The preset prompt word template includes at least the instruction word, vulnerability database background information, and output format requirements.

8. A vulnerability number identification system based on multi-model collaboration and semantic understanding, characterized in that, include: The preprocessing module receives raw network traffic and performs protocol parsing and normalization to extract multi-dimensional feature vectors. A rapid initial screening module includes: at least two malicious detection units for parallel processing of the multidimensional feature vectors and outputting classification results and confidence scores; and a decision fusion unit for fusing the classification results and confidence scores according to multi-model decision rules and outputting a joint judgment result. The deep analysis module is used to extract complete request payload data for traffic that is determined to be malicious or suspicious by the joint judgment. The vulnerability number output module is used to combine the request payload data with the prompt word template, input it into the security big language model, and receive the standard vulnerability number directly output by it; the security big language model is a big language model optimized by network security domain instruction corpus and adaptive simulation vulnerability corpus.

9. The vulnerability number identification system according to claim 8, characterized in that, The multi-model decision rule applied by the decision fusion unit is as follows: If all the classification results output by the malicious detection units are normal, then the joint judgment result is normal; If all the classification results output by the malicious detection units are malicious, then the joint judgment result is malicious; If at least one of the malicious detection units outputs a classification result of malicious, or if the confidence level of the malicious category output by at least one of the malicious detection units is higher than a preset numerical threshold, then the joint determination result is suspicious.

10. The vulnerability number identification system according to claim 8, characterized in that, It also includes a model training module for performing instruction fine-tuning and reinforcement learning fine-tuning of the security big language model and executing the active learning process to train the malicious detection model.

Images