A large language model-based attack technology prediction method and device

Abstract

The application provides an attack technology prediction method and device based on a large language model, which comprises the following steps: obtaining historical attack data of an attacker and performing data modeling to construct a bipartite graph; generating a structured context input large language model according to the bipartite graph; constructing a prediction prompt word, which guides the large language model to perform attack technology prediction according to the structured context to obtain a preliminary prediction result, and performing attack stage filtering and sorting screening on the preliminary prediction result according to a set standard to obtain a final attack technology prediction result. The method can stimulate the recommendation ability of the large language model, improve the adaptability and learning ability of the large language model to specific security tasks, fully utilize the scene learning ability of the large language model, effectively cope with new attack modes, reduce the dependence on a large amount of labeled data, and especially in the case of data scarcity or serious cold start problem, help to improve the accuracy of the generated result.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for predicting attack techniques based on a large language model. Background Technology

[0002] In today's rapidly evolving cybersecurity landscape, the detection and defense against Advanced Persistent Threats (APTs) has become a significant challenge for security operations centers. APT attacks are typically launched by highly specialized attackers with clear objectives, covert operations, and long durations. Attackers may employ different techniques and strategies at each stage, from initial penetration to lateral movement, data theft, and persistence. Each step can be highly covert, making it difficult to accurately identify and track the attack behavior within massive amounts of network logs. The diverse and constantly evolving attack patterns mean that even experienced security analysts struggle to fully grasp all known attack techniques and tactics. The characteristics of APT attacks render traditional security defense mechanisms ineffective. As network environments become increasingly complex and attack techniques continue to advance, the task of detecting and defending against APT attacks becomes even more challenging.

[0003] Existing attack technique prediction methods are ill-suited for APT attack prediction tasks:

[0004] Existing attack technique prediction methods based on manual analysis offer the greatest flexibility, integrating multi-dimensional, multi-modal data with the accumulated experience of professionals. Predicting potential future attack patterns often requires cross-document analysis, making this task highly dependent on the security analyst's expertise and current operational status. Making reasonable predictions based on historical data requires security analysts to sift through massive amounts of network logs and security alerts to extract truly valuable information. This is not only a time- and resource-intensive task but also prone to information overload, impacting the analyst's efficiency and accuracy.

[0005] Machine learning-based classification and clustering algorithms can perform attribution analysis on the attacks that attackers may take. However, traditional machine learning-based analysis methods often ignore the multi-stage and temporal characteristics of APT attacks. Due to the loss of a large amount of information, the level of prediction is limited, especially when dealing with complex APT attacks, the prediction results are not reliable enough.

[0006] Collaborative filtering-based methods transfer the collaborative filtering approach from recommender systems to attack technique prediction, providing personalized attack technique predictions for each potential attacker by analyzing the behavioral patterns of different attackers. However, the effectiveness of this approach largely depends on a sufficient amount of historical interaction data. In practical applications, especially in scenarios involving new systems or a small number of attackers, the data may be very sparse, which will significantly affect the accuracy and reliability of the predictions.

[0007] Therefore, it is necessary to provide an attack technique prediction method that can improve prediction accuracy by addressing data sparsity. Summary of the Invention

[0008] The purpose of this invention is to provide an attack technique prediction method based on a large language model, so as to improve the accuracy of attack technique prediction and address the problems of data sparsity and cold start.

[0009] In a first aspect, the attack technique prediction method based on a large language model provided by the present invention includes: acquiring historical attack data of attackers and performing data modeling to construct a bipartite graph, the bipartite graph being used to represent the relationship between attack organizations and attack techniques; generating a structured context based on the bipartite graph and inputting it into the large language model; constructing prediction prompts, the prediction prompts guiding the large language model to predict attack techniques based on the structured context to obtain preliminary prediction results; and filtering and sorting the preliminary prediction results according to set criteria to obtain the final attack technique prediction results.

[0010] The beneficial effects of the attack technique prediction method based on a large language model provided by this invention are as follows: Addressing the technical challenges of sparse, discontinuous, long-tailed categories, and insufficient training samples in APT attack behavior data, a prediction process of "structured bipartite graph—multidimensional semantic enhancement—controlled cue reasoning—confidence ranking screening" is designed. This enables the large language model to maintain predictive ability under unsupervised, low-sample, or emerging threat conditions. Constructing specific cue words stimulates the recommendation ability of the large language model, enhancing its adaptability and learning ability for specific security tasks. It fully utilizes the in-scene learning ability of the large language model, effectively responding to newly emerging attack patterns, reducing dependence on large amounts of labeled data. Especially in situations where data is scarce or the cold start problem is severe, it helps improve the accuracy of the generated results and is highly flexible, allowing adjustments to be made according to different task requirements.

[0011] In one possible embodiment, acquiring the attacker's historical attack data and constructing a bipartite graph through data modeling includes: creating a binary table based on the attacker's use of attack techniques in the historical attack data; and constructing a bipartite graph based on the binary table, the structure of which is represented as follows: ,in, Represents the set of attacker nodes. This represents a set of attack techniques nodes. This represents a set of edges, which are created based on the values ​​of cells in a binary table.

[0012] In another possible embodiment, generating a structured context based on a bipartite graph includes: converting the bipartite graph into a serialized representation; determining whether the number of attack techniques corresponding to each attacker exceeds a preset redundancy threshold; if the determination result is yes, performing information gain sorting and selecting retained information; and generating a structured context based on the retained information.

[0013] In other possible embodiments, when constructing prediction prompts, examples are selected based on historical attack data and added to the prompts to guide the large language model in analogy prediction; the selection examples include: calculating attacker similarity according to the following formula: ,in, , This indicates two different attackers. This indicates the attackers identified based on historical attack data. The set of attack techniques used This indicates the attackers identified based on historical attack data. The set of attack techniques used; Top-k attackers were selected as examples based on attacker similarity.

[0014] The preliminary prediction results are filtered and sorted according to the set criteria to obtain the final attack technology prediction results. This includes: removing attack technologies not registered in the ATT&CK framework and technologies that do not match the target platform from the preliminary prediction results; calculating the corresponding fusion index scores based on the model recommendation confidence, contribution probability of attack technologies in similar organizations, and tactical phase logical rationality of the filtered preliminary prediction results; sorting the preliminary prediction results according to the fusion index scores and selecting the preliminary prediction results with fusion index scores exceeding the preset confidence threshold as the final attack technology prediction results.

[0015] The attack phase filtering of the preliminary prediction results based on the set criteria also includes filtering the attacker's historical use of attack techniques.

[0016] The calculation of the fusion index score satisfies the following formula:

[0017] ,in, , , Represents the weight parameters. This represents the confidence score of the model recommendation obtained from the large language model. This represents the co-occurrence probability of attack techniques in similar organizations. This indicates the logical rationality of the tactical phase.

[0018] The assignment of logical rationality for the tactical phase includes: constructing a set of subsequent phases for the attack tactics based on the phase constraints of the ATT&CK attack technique, satisfying: , , This represents the parameters in the attack phase sequence mapped according to the ATT&CK attack technique; the logical rationality of the tactical phase is scored based on the relationship between the prediction results and the current and subsequent phase sets, and the scoring rules satisfy the following formula:

[0019] ,in, Indicates the prediction result. Indicates the currently observed stage. This represents the set of successor stages of the current stage. This represents a compromise weight between 0 and 1.

[0020] After obtaining the attack technique prediction results, the process also includes: constructing a visualization based on historical attack data and attack technique prediction results, with entities constructed based on historical attack data and entities constructed based on attack technique prediction results represented by different labels in the visualization.

[0021] Secondly, the present invention also provides an attack technique prediction device based on a large language model, comprising: a data preparation unit for acquiring historical attack data of attackers and performing data modeling to construct a bipartite graph, the bipartite graph being used to represent the relationship between attack organizations and attack techniques; a context input unit for generating a structured context input large language model based on the bipartite graph; and an analysis and prediction unit for constructing prediction prompts, the prediction prompts guiding the large language model to predict attack techniques based on the structured context to obtain preliminary prediction results, and filtering and sorting the preliminary prediction results according to set criteria to obtain the final attack technique prediction results.

[0022] For the beneficial effects of the second aspect, please refer to the description of the first aspect above. Attached Figure Description

[0023] Figure 1 A flowchart illustrating an attack technique prediction method for a large language model provided in an embodiment of the present invention;

[0024] Figure 2 A schematic diagram illustrating the working framework of an attack technique prediction method for a large language model provided in an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of an attack technique prediction device for a large language model provided in an embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0028] This embodiment provides a method and apparatus for predicting attack techniques based on a large language model.

[0029] See Figure 1 and Figure 2 Attack technique prediction methods based on large language models include:

[0030] S101: Obtain the attacker's historical attack data and perform data modeling to construct a bipartite graph, which is used to represent the relationship between the attack organization and the attack techniques.

[0031] In one possible embodiment, acquiring the attacker's historical attack data and constructing a bipartite graph through data modeling includes: creating a binary table based on the attacker's use of attack techniques in the historical attack data; and constructing a bipartite graph based on the binary table, the structure of which is represented as follows: ,in, Represents the set of attacker nodes. This represents a set of attack techniques nodes. This represents a set of edges, which are created based on the values ​​of cells in a binary table.

[0032] In one specific embodiment, historical attack data is data collected from sources such as the MITRE ATT&CK website regarding attacker groups and their past attack techniques. This historical attack data is abstracted and a binary table is created. As shown in Table 1, the rows of the binary table represent attackers, and the columns represent attack techniques. If an attacker uses a specific attack technique, the corresponding cell is set to 1; otherwise, it is set to 0.

[0033] Table 1 Attacker-Attack Technique Binary Table

[0034] T1190 T1203 1068 T1133 T1090 G0001 1 0 0 0 0 G0002 0 1 1 0 1 G0003 0 0 0 1 0 G0004 0 1 1 0 0

[0035] After creating the binary table, transform it into a bipartite graph structure: construct the nodes, including defining the attacker node set. Each attacker is treated as a node; define the set of attack technique nodes. Each attack technique is treated as a node; attacker nodes and attack technique nodes are mutually exclusive, and there are no connections between nodes of the same type. Edge construction: If the cell in the i-th row and j-th column of the binary table... Then, a path is created in the bipartite graph from the attacker node. Targeting attack technology nodes An undirected or directed edge; if If the condition is met, no edges are created. The resulting bipartite graph can be represented as follows: ,in .

[0036] In one possible implementation, when constructing the edges of a bipartite graph, weights can be assigned to the edges, such as based on the frequency of occurrence, source credibility, time decay coefficient, etc.

[0037] S102: Generate a structured contextual input large language model based on the bipartite graph.

[0038] In one possible embodiment, generating a structured context based on a bipartite graph includes: converting the bipartite graph into a serialized representation; determining whether the number of attack techniques corresponding to each attacker exceeds a preset redundancy threshold; if the determination result is yes, performing information gain sorting and selecting retained information; and generating a structured context based on the retained information.

[0039] For example, a bipartite diagram The converted serialized representation is shown below:

[0040] Group G001:

[0041] Used techniques = [T1059.003, T1547.001, T1003.001]

[0042] Group G014:

[0043] Used techniques = [T1190, T1133]

[0044] Target Group:

[0045] Historical techniques = [T1059.003, T1547.001].

[0046] In a specific embodiment, the preset redundancy threshold is 30. Based on the converted serialized representation, if the number of attack techniques corresponding to the attacker is greater than 30, the attack techniques are sorted by information gain, and the top K most distinctive attack techniques are retained. If the number of attack techniques corresponding to the attacker is ≤30, all corresponding attack technique information is retained. Then, a structured context is generated based on all retained information. Sorting the information with more attack techniques than the redundancy threshold by gain and selecting some for retention can suppress vector redundancy, thereby generating a structured context as input data for a large language model, which is beneficial to improving the model's inference efficiency. The specific values ​​of the redundancy threshold and K can be defined by the user.

[0047] S103: Construct prediction prompts. The prediction prompts guide the large language model to predict attack techniques based on the structured context to obtain preliminary prediction results. The preliminary prediction results are then filtered and sorted according to the set criteria to obtain the final attack technique prediction results.

[0048] In one possible embodiment, when constructing prediction prompts, examples are selected based on historical attack data and added to the prompts to guide the large language model in analogy prediction; the selection of examples includes: calculating attacker similarity according to the following formula: ,in, , This indicates two different attackers. This indicates the attackers identified based on historical attack data. The set of attack techniques used This indicates the attackers identified based on historical attack data. The set of attack techniques used, with the Top-k attackers selected as examples based on attacker similarity.

[0049] In one possible embodiment, the preliminary prediction results are filtered and sorted according to set criteria to obtain the final attack technology prediction results. This includes: removing attack technologies not registered in the ATT&CK framework and technologies that do not match the target platform from the preliminary prediction results; calculating the corresponding fusion index score based on the model recommendation confidence, contribution probability of the attack technology in similar organizations, and tactical stage logical rationality of the filtered preliminary prediction results; sorting the preliminary prediction results according to the fusion index scores and selecting the preliminary prediction results with fusion index scores exceeding a preset confidence threshold as the final attack technology prediction results.

[0050] In one specific embodiment, the attack phase filtering of the preliminary prediction results based on set criteria also includes filtering the attacker's historical use of attack techniques.

[0051] In a specific embodiment, the calculation of the fusion metric score satisfies the following formula:

[0052] ,in, , , Represents the weight parameters. This represents the confidence score of the model recommendation obtained from the large language model. This represents the co-occurrence probability of attack techniques in similar organizations. This indicates the logical rationality of the tactical phase.

[0053] The assignment of logical rationality for the tactical phase includes: constructing a set of subsequent phases for the attack tactics based on the phase constraints of the ATT&CK attack technique, satisfying: , , This represents the parameters in the attack phase sequence mapped according to the ATT&CK attack technique; the logical rationality of the tactical phase is scored based on the relationship between the prediction results and the current and subsequent phase sets, and the scoring rules satisfy the following formula:

[0054] ,in, Indicates the prediction result. Indicates the currently observed stage. This represents the set of successor stages of the current stage. This represents a compromise weight between 0 and 1.

[0055] Prediction prompts are used to interact with large language models to guide them in generating reasonable predictions based on task requirements. For example, prediction prompts may include known attackers and corresponding attack technique examples, task descriptions, post-processing of model-generated results, and selection criteria. Providing examples through prediction prompts enables the large language model to make analogical predictions, improving the quality of the model's output. Constraining the output with clear task descriptions and post-processing and selection criteria ensures that the obtained attack technique predictions are reasonable and match the attacker's likely behavior, preventing hallucinatory outputs.

[0056] The known attackers and corresponding attack technique examples provided in the prediction prompts are obtained by the system based on set conditions. Specifically, the attacker similarity is first calculated, i.e., the Jaccard similarity or cosine similarity between attackers, using the following formula: The algorithm selects the top-k attackers with the closest similarity as few-shot examples to ensure that the examples are structurally relevant rather than irrelevant. The specific number of top-k attackers selected can be defined by the user.

[0057] The prediction results generated by the large language model are not directly output. Instead, the prediction results are post-processed and filtered according to the attack stage filtering and sorting criteria set in the prediction prompts to ensure that the final attack technique prediction results are reasonable and match the attacker's possible behavior.

[0058] For example, the steps for post-processing and filtering the prediction results generated by the large language model can be as follows: Step 1: Remove attack techniques not registered in the ATT&CK framework; Step 2: Remove attack techniques that do not match the target platform; Step 3: Filter historically used attack techniques (optional); Step 4: Calculate the fusion index score of the filtered attack techniques; Step 5: Set the confidence threshold θ; Step 6: Output the Top-N recommendation results with fusion index scores higher than the confidence threshold (if the fusion index score of no attack technique exceeds the confidence threshold, output "unpredictable" to avoid forced output of illusory information).

[0059] Calculation formula for fusion index score middle, The confidence level of the model recommendation is generated using a large language model. This indicates the co-occurrence probability of attack techniques in similar organizations.

[0060] The specific method for calculating the co-occurrence probability of attack techniques in similar organizations is as follows: using the Jaccard similarity formula. Identify the attackers whose behavior most closely resembles that of the current target in the historical database. Individual attackers, forming a similar group of organizations. Calculate the co-occurrence probability: for the initially predicted candidate technologies... Its co-occurrence probability is a candidate technology In similar organizational sets The degree of coverage. The calculation formula is: ,in, As an indicator function, if the organization is determined based on the historical database... Historically used technology If the value is 1, then the value is 1; otherwise, the value is 0. The number of similar organizations.

[0061] The tactical phase logic is used to measure the logical continuity between the ATT&CK tactical phase of the candidate attack technique obtained after filtering and the currently observed attack phase sequence: when the candidate attack technique is in the current phase or its predefined set of reasonable successor phases, a higher score is assigned; when the phase of the candidate attack technique is obviously inconsistent with the attack process, a lower score is assigned, thereby suppressing recommended results that do not conform to the evolution of the attack chain.

[0062] Weight parameters , , The range of values ​​satisfies At the same time, in order to ensure the score of the fusion indicator Consistency requires satisfying The constraint relationship.

[0063] The process of predefining a reasonable set of successor stages for candidate attack techniques includes: ATT&CK attack techniques Mapping to its respective tactical phase, although it is not mandatory for tactical phases to appear in sequence, there are certain constraints on each phase. Based on the typical attack chain, a reasonable set of phase jumps for tactical phases is defined, and it is formalized into a allowed jump matrix or adjacency list to obtain the set of successor phases.

[0064] For example, the ATT&CK framework divides attack tactics into 14 stages in sequence, as follows: 1. Reconnaissance: Intelligence gathering, target identification, network reconnaissance; 2. Resource Development: Building infrastructure, registering domains, acquiring tools, implanting accounts, etc.; 3. Initial Access: Phishing emails, malicious websites, watering hole attacks, vulnerability exploitation, etc.; 4. Execution: Running malicious code or scripts in the target environment; 5. Persistence: Maintaining access after system restarts or account changes; 6. Privilege Escalation: Elevating from ordinary privileges to higher privileges; 7. Defense Evasion: Circumventing antivirus, EDR, log auditing, and obfuscation behaviors; 8. Credential Access: Stealing passwords, tokens, hashes, and Kerberos. 9. Discovery (Information Gathering / Lateral Preparation): Enumerating networks, systems, services, permissions, and assets. 10. Lateral Movement: Moving from one host to another or to another environment. 11. Collection: Collecting target data, taking screenshots, logging keystrokes, and acquiring databases. 12. Command and Control (C2): Establishing a communication channel with the attacker's remote server. 13. Exfiltration: Data compression, encryption, transmission, and covert transmission. 14. Impact: Damage, ransomware attacks, data tampering, denial of service, and disruption of system availability. ATT&CK attack techniques. Mapping to its corresponding tactical phase is denoted as: .

[0065] The set of subsequent stages is a set of reasonable stage jumps predefined according to a typical attack chain. For example, when the current stage is Execution, reasonable next stages include: Privilege Escalation, Lateral Movement, and Defense Evasion; when the current stage is Privilege Escalation, reasonable next stages include: Lateral Movement and Credential Access, etc.

[0066] tactical phase logical rationality The scoring rules are as follows: High continuity case: If the prediction technique Stage Compared with the current observation phase They are the same, or belong to a predefined set of successor stages. If it is high continuity, it is assigned a value of 1. Medium continuity case: If... If a transition does not belong to a direct successor phase but is within the "acceptable set of extended phases" (such as a rollback from the privilege escalation phase to the execution phase), it is considered a logically possible non-linear transition and assigned a compromise weight. .in, The recommended range of values ​​is: Specifically, the settings can be preset according to the level of conservatism required for the defense scenario. Low continuity: If If it is neither the current or subsequent stage nor within the set of extended stages, it is considered logically incoherent and assigned a value of 0.

[0067] The phase_continuity scoring rule can be described by a simple function: ,in, The weight is a compromise between 0 and 1.

[0068] It should be noted that:

[0069] Successor phase set This refers to the next step in the direct evolution of a typical linear attack lifecycle.

[0070] Acceptable extended phase set: refers to atypical transitions in complex APT attacks that, while not belonging to the optimal linear path, possess operational logic rationality. It includes the following two scenarios: 1. Phase rollback: To expand the gains, rolling back from a later phase to an earlier phase. For example, after reaching the "10-Lateral Movement" phase, returning to the "4-Execution" phase to run a new probe script. 2. Cross-phase jump: Due to weak defenses in the target environment, attackers bypass intermediate steps by directly jumping. For example, exploiting certain high-privilege vulnerabilities to directly jump from "4-Execution" to "6-Privilege Escalation" without going through intermediate processes. In this invention, historical threat intelligence from ATT&CK is used to pre-define " "

[0071] In one possible embodiment, after obtaining the attack technique prediction result, the method further includes: constructing a visualization based on historical attack data and the attack technique prediction result, wherein entities constructed based on historical attack data and entities constructed based on attack technique prediction result are represented by different labels in the visualization.

[0072] Because the output of large language models is unstructured text or a set of numbers, it lacks information that directly presents the threat process to the protected user, such as attack stages, contextual semantics, and relational expressions. Furthermore, simply outputting prediction results cannot support tracing the source, determining the basis for judgment, or identifying the attack chain position, thus lacking operability. The attack technique prediction method based on large language models provided in this embodiment constructs a visualization after obtaining the attack technique prediction results. It maps the entities and relational nodes of the visualization based on historical attack data and the attack technique prediction results, and distinguishes between information about past events obtained from historical attack data and information about future possible events predicted by the attack technique prediction results. This allows for a more intuitive presentation of the prediction results and improves their interpretability.

[0073] In a specific embodiment, during the visualization of attack technique prediction results, circles of different colors are used to represent different types of entities and the relationships between them. Specifically, this includes: constructing input attack technique entities based on historical attack data. These entities represent techniques known to or already used by the attacker, indicated by red circles. The attack techniques represented by these entities serve as the starting point for analysis, reflecting the attacker's current capabilities and preferences. Next, constructing recommended attack technique entities based on the attack technique prediction results. These entities represent techniques that the large language model analyzes and predicts the attacker might employ. The large language model obtains these techniques based on prediction prompts, contextual prediction, attack stage filtering, and sorting, and includes confidence scores and the current attack stage. These entities represent potential attack warnings. Finally, constructing attacker entities. These entities are the implementers of the attack techniques, indicated by blue circles, and are connected to the corresponding attack techniques, providing information to help understand the attacker's background and motivations. In the final visualization, each attack technique node has a unique technique ID, and information can be expanded or navigated through front-end interactive controls. The semantic description of the attack technique, the attack stage, the potential impact, the relevant threat organizations, and the reference sources are stored in the node attribute fields and dynamically displayed during user interaction.

[0074] For example, the prediction result visualization could be a main graph that only displays the ATT&CK technology number, but each node is bound to specific attribute information to avoid node congestion. Taking the node with ATT&CK technology number T1059.003 as an example, the node is bound to the following attributes:

[0075] 1.id: 'T1059.003'

[0076] 2.name: 'Command and Scripting Interpreter: PowerShell'

[0077] 3. stage: 'Execution'

[0078] 4.description: 'Adversaries may abuse PowerShell to executecommands.'

[0079] 5.reference: 'https: / / ******.*****.*** / techniques / T1059 / 003 / '

[0080] source: 'historical / prediction'.

[0081] The above data is persistently stored and retrieved using a graph database, creating an interconnected network containing all the aforementioned elements. This network not only displays each attack pattern and attacker organization but also the relationships between them. This visualization of relationships helps security analysts discover potential attack patterns, predict attackers' next moves, and formulate defense strategies accordingly.

[0082] The visual graph design features the following characteristics: Avoiding node explosion: Too many long-tail techniques can make the graph unreadable, requiring layered and collapsed display. Visual differentiation between predicted and historical nodes: Different colors, labels, and line styles. Dynamic update mechanism: Prediction results written to the graph database must maintain idempotency, preventing duplicate nodes. Support for time-series views: Attack behaviors can be queried and displayed according to their evolution over time.

[0083] The attack technique prediction method based on large language models provided by this invention utilizes large language models to process and analyze historical attack data of attackers to predict their potential future attack patterns. By applying the powerful natural language processing capabilities of large language models to recommendation systems in the security field, the prediction accuracy and efficiency of the system are improved.

[0084] Instead of the traditional log-stack-based general model question-answering approach, this invention addresses the technical challenges of sparse, discontinuous, long-tailed categories, and insufficient training samples in APT attack data by designing a prediction process of "structured bipartite graph—multidimensional semantic enhancement—controlled cueing inference—confidence ranking filtering." This design enables the large language model to maintain predictive ability under unsupervised, low-sample, or emerging threat conditions. Specifically, the multidimensional semantic enhancement achieved in this invention involves: using serialization conversion technology to transform the structural relationships of the bipartite graph into textual semantics; introducing attacker similarity calculation into similar behavior examples to achieve analogical semantic enhancement under limited sample conditions; and finally, combining the tactical phase constraints and co-occurrence probabilities of similar organizations within the ATT&CK framework to enhance the semantic prediction of attack techniques from different dimensions of logical continuity and statistical reliability.

[0085] Constructing specific prompts to stimulate the recommendation capabilities of a large language model allows the system to analyze and predict attacker behavior from different perspectives, providing more comprehensive and accurate recommendations for security analysis. Enhancing the adaptability and learning ability of the large language model to specific security tasks through examples and specific prompts fully leverages its in-context learning capabilities, effectively addressing emerging attack patterns and reducing reliance on large amounts of labeled data. This is particularly beneficial in situations where data is scarce or cold-start issues are severe, thus improving the accuracy of generated results. Furthermore, this method is highly flexible and can be adjusted according to different task requirements.

[0086] Using graph database technology for persistent storage, querying, and visualization of results allows for a more intuitive graphical representation, enabling security analysts to more easily understand potential attacker behavior and recommended attack techniques. This not only improves the interpretability of recommendations but also provides strong support for security decision-making.

[0087] See the instruction manual appendix Figure 3 This embodiment also provides an attack technique prediction device based on a large language model, which is used to implement the above method embodiment. The device includes:

[0088] The data preparation unit 201 is used to acquire historical attack data of attackers and perform data modeling to construct a bipartite graph, which is used to represent the relationship between attack organizations and attack techniques.

[0089] The context input unit 202 is used to generate a structured context input large language model based on the bipartite graph.

[0090] The analysis and prediction unit 203 is used to construct prediction prompts. The prediction prompts guide the large language model to predict attack techniques based on the structured context to obtain preliminary prediction results. The preliminary prediction results are then filtered and sorted according to the set criteria to obtain the final attack technique prediction results.

[0091] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0092] In other embodiments of this application, an electronic device is disclosed, such as... Figure 4 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the various steps in the corresponding embodiments.

[0093] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0094] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0095] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0096] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for predicting attack techniques based on a large language model, characterized in that, include: The attacker's historical attack data is obtained and a bipartite graph is constructed using data modeling. The bipartite graph is used to represent the relationship between the attack organization and the attack techniques. The structured context is generated based on the bipartite graph and input into the large language model. The generation of the structured context based on the bipartite graph includes: converting the bipartite graph into a serialized representation, determining whether the number of attack techniques corresponding to each attacker exceeds a preset redundancy threshold, and when the determination result is yes, performing information gain sorting and selecting retained information, and generating a structured context based on the retained information. A prediction prompt is constructed, which guides a large language model to predict attack techniques based on structured context to obtain preliminary prediction results. The preliminary prediction results are then filtered and sorted according to set criteria to obtain the final attack technique prediction results. The filtering and sorting of the preliminary prediction results according to set criteria to obtain the final attack technique prediction results includes: removing attack techniques not registered in the ATT&CK framework and techniques that are incompatible with the target platform from the preliminary prediction results; calculating the corresponding fusion index score based on the model recommendation confidence, contribution probability of the attack technique in similar organizations, and tactical stage logical rationality of the filtered preliminary prediction results; sorting the preliminary prediction results according to the fusion index scores and selecting the preliminary prediction results with fusion index scores exceeding a preset confidence threshold as the final attack technique prediction results. When constructing prediction prompts, examples are selected from historical attack data and added to the prompts to guide the large language model in analogy prediction. These selected examples include: calculating attacker similarity using the following formula: ,in, , This indicates two different attackers. This indicates the attackers identified based on historical attack data. The set of attack techniques used This indicates the attackers identified based on historical attack data. The set of attack techniques used; Top-k attackers were selected as examples based on attacker similarity.

2. The method according to claim 1, characterized in that, Obtaining historical attack data from attackers and constructing a bipartite graph through data modeling includes: Create a binary table based on the attacker's use of attack techniques in historical attack data; A bipartite graph is constructed based on the binary table, and the structure of the bipartite graph is represented as follows: ,in, Represents the set of attacker nodes. This represents a set of attack techniques nodes. This represents a set of edges, which are created based on the values ​​of cells in the binary table.

3. The method according to claim 1, characterized in that, The attack phase filtering of the preliminary prediction results based on the set criteria also includes filtering the attacker's historical use of attack techniques.

4. The method according to claim 1, characterized in that, The calculation of the fusion index score satisfies the following formula: ,in, , , Represents the weight parameters. This represents the confidence score of the model recommendation obtained from the large language model. This represents the co-occurrence probability of attack techniques in similar organizations. This indicates the logical rationality of the tactical phase.

5. The method according to claim 1, characterized in that, The logical rationality assignment in the tactical phase includes: Construct a set of subsequent phases for the attack tactics based on the phase constraints of the ATT&CK attack technique, satisfying: , , This represents the parameters in the attack phase sequence obtained by mapping according to the ATT&CK attack technique; The logical rationality of the tactical phase is scored based on the relationship between the prediction results and the current and subsequent phase sets. The scoring rules satisfy the following formula: ,in, Indicates the prediction result. Indicates the currently observed stage. This represents the set of successor stages of the current stage. This represents a compromise weight between 0 and 1.

6. The method according to claim 1, characterized in that, After obtaining the attack technique prediction results, it also includes: A visualization is constructed based on the historical attack data and the attack technique prediction results. Entities constructed based on the historical attack data and entities constructed based on the attack technique prediction results in the visualization are represented by different labels.

7. An attack technique prediction device based on a large language model, characterized in that, The device includes: The data preparation unit is used to acquire historical attack data of attackers and perform data modeling to construct a bipartite graph, which is used to represent the relationship between attack organizations and attack techniques. The context input unit is used to generate a structured context input large language model based on the bipartite graph. The generation of structured context based on the bipartite graph includes: converting the bipartite graph into a serialized representation, determining whether the number of attack techniques corresponding to each attacker exceeds a preset redundancy threshold, and when the determination result is yes, performing information gain sorting and selecting retained information, and generating structured context based on the retained information. An analysis and prediction unit is used to construct prediction prompts. These prompts guide a large language model to predict attack techniques based on structured context to obtain preliminary prediction results. The preliminary prediction results are then filtered and sorted according to set criteria to obtain the final attack technique prediction results. This filtering and sorting process includes: removing attack techniques not registered in the ATT&CK framework and techniques incompatible with the target platform from the preliminary prediction results; calculating corresponding fusion index scores based on the model recommendation confidence, contribution probability of the attack techniques in similar organizations, and tactical stage logical rationality of the filtered preliminary prediction results; and sorting the preliminary prediction results according to the fusion index scores and selecting those with fusion index scores exceeding a preset confidence threshold as the final attack technique prediction results. When constructing prediction prompts, examples are selected from historical attack data and added to the prompts to guide the large language model in analogy prediction. These selected examples include: calculating attacker similarity using the following formula: ,in, , This indicates two different attackers. This indicates the attackers identified based on historical attack data. The set of attack techniques used This indicates the attackers identified based on historical attack data. The set of attack techniques used; Top-k attackers were selected as examples based on attacker similarity.

Images