A network attack detection method, system, device and storage medium

Abstract

This application provides a network attack detection method, system, device, and storage medium. The method includes: acquiring network data; constructing a first prompt word based on the network data, including model roles, network data, model tasks, and model output format; inputting the first prompt word into a first model to perform preliminary detection on the network data, outputting preliminary results, and preliminarily determining whether the network data has attack characteristics and its attack type; marking network data with attack characteristics in the preliminary results as target data; retrieving related knowledge matching the attack type of the target data from a knowledge base; constructing a second prompt word based on the related knowledge, including a set of historical attack cases, location information of historical network attack characteristics, historical network attack detection rules, and model output format; inputting the second prompt word and the target data into a second model to perform deep detection on the target data, outputting deep results, and determining whether the target data has attack characteristics and its attack type.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network attack detection method, system, device and storage medium. Background Technology

[0002] With the deep integration of 5G, IoT, cloud computing, and AI technologies, cyberspace has become a core carrier supporting the operation of critical infrastructure and socio-economic development. Simultaneously, cyberattack methods are rapidly evolving towards intelligence, concealment, and diversification, with new attack techniques and variant attack signatures emerging constantly, posing severe challenges to the real-time performance and accuracy of cybersecurity protection systems. Traditional detection technologies based on static rule bases and signature matching are generally prone to high false negative and false positive rates due to their inability to adapt to dynamically changing attack patterns, and thus cannot meet the current practical needs of cybersecurity protection.

[0003] In recent years, large language models have demonstrated significant application potential in the field of network attack detection due to their powerful contextual understanding, natural language reasoning, and pattern recognition capabilities, becoming an important direction for replacing traditional detection technologies. However, current network attack detection schemes based on large language models still have obvious shortcomings: the pre-training corpora of general-purpose large language models have limited coverage of network security expertise, lack effective support from domain-specific knowledge, lack specificity in identifying various attack characteristics, are prone to "knowledge illusions," and are unable to meet the accurate detection needs in complex attack scenarios, resulting in insufficient detection accuracy. At the same time, current schemes mostly use fixed prompt word templates to drive large language models for detection, making it impossible for them to dynamically adjust the detection logic according to different attack types, further exacerbating detection bias and reducing detection accuracy. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this application provides a network attack detection method, system, device and storage medium.

[0005] According to a first aspect of the embodiments of this application, a network attack detection method is provided, the method comprising:

[0006] Acquire network data, which is used to characterize the real-time network operating status;

[0007] Based on the network data, a first prompt word for the first detection model is constructed. The first prompt word includes the role definition of the first detection model, the network data, the recognition task instructions of the first detection model, and the result output format of the first detection model.

[0008] The first prompt word is input into the first detection model to perform preliminary network attack detection on the network data and output preliminary detection results; the preliminary detection results are used to preliminarily determine whether the network data has network attack characteristics and the corresponding attack type.

[0009] Network data that is determined by the preliminary detection results to have network attack characteristics is marked as target network data;

[0010] Retrieve relevant knowledge matching the attack type corresponding to the target network data from a preset knowledge base;

[0011] Based on the associated knowledge, a second prompt word is constructed for the second detection model. The second prompt word includes the set of historical attack cases in the associated knowledge, the location information of historical network attack features in the associated knowledge, the historical network attack detection rules in the associated knowledge, and the result output format of the second detection model.

[0012] The second prompt word and the target network data are input into the second detection model to perform deep network attack detection on the target network data and output the deep detection result; the deep detection result is used to determine whether the target network data has network attack characteristics and the corresponding attack type.

[0013] According to a second aspect of the embodiments of this application, a network attack detection system is provided, the system comprising:

[0014] Several network devices, wherein the network devices are devices in the network that may be subject to network attacks;

[0015] A network attack detection device, communicatively connected to the network device, is used to execute the network attack detection method described in the first aspect.

[0016] According to a third aspect of the embodiments of this application, a network attack detection device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network attack detection method described in the first aspect.

[0017] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein the computer program, when executed by a processor, implements the network attack detection method described in the first aspect.

[0018] The technical solutions provided in this application embodiment may include the following beneficial effects:

[0019] In this embodiment, a two-level detection model works collaboratively. First, a first detection model, combined with a common first prompt word, performs preliminary attack detection on network data, quickly identifying potential attack data. Then, for the attack type determined by the preliminary detection, matching related knowledge is retrieved from a professional knowledge base to construct a dynamic second prompt word containing historical attack cases, attack feature location information, and detection rules. This second prompt word is then input into a second detection model for deep detection. By introducing precise knowledge support from a professional knowledge base, the limitations of the professional knowledge in large language models are effectively compensated for, reducing the generation of "knowledge illusions." Simultaneously, the design of dynamically generating prompt words based on attack types makes the detection logic of the detection model more targeted, significantly improving the detection accuracy of different types of attacks and providing more reliable technical support for network security protection.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this application, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0022] Figure 1 This is a schematic diagram of the structure of a network attack detection system according to an exemplary embodiment of this application.

[0023] Figure 2 This is a flowchart illustrating a network attack detection method according to an exemplary embodiment of this application.

[0024] Figure 3 This is a schematic diagram illustrating the structure of another network attack detection system according to an exemplary embodiment of this application.

[0025] Figure 4 This is a flowchart illustrating a source tracing and evidence collection method according to an exemplary embodiment of this application.

[0026] Figure 5 This is a schematic diagram of the structure of a network attack detection device according to an exemplary embodiment of this application. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0028] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0029] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0030] With the deep integration of 5G, IoT, cloud computing, and AI technologies, cyberspace has become a core carrier supporting the operation of critical infrastructure and socio-economic development. Simultaneously, cyberattack methods are rapidly evolving towards intelligence, concealment, and diversification, with new attack techniques and variant attack signatures emerging constantly, posing severe challenges to the real-time performance and accuracy of cybersecurity protection systems. Traditional detection technologies based on static rule bases and signature matching are generally prone to high false negative and false positive rates due to their inability to adapt to dynamically changing attack patterns, and thus cannot meet the current practical needs of cybersecurity protection.

[0031] In recent years, large language models have demonstrated significant application potential in the field of network attack detection due to their powerful contextual understanding, natural language reasoning, and pattern recognition capabilities, becoming an important direction for replacing traditional detection technologies. However, current network attack detection schemes based on large language models still have obvious shortcomings: the pre-training corpora of general-purpose large language models have limited coverage of network security expertise, lack effective support from domain-specific knowledge, lack specificity in identifying various attack characteristics, are prone to "knowledge illusions," and are unable to meet the accurate detection needs in complex attack scenarios, resulting in insufficient detection accuracy. At the same time, current schemes mostly use fixed prompt word templates to drive large language models for detection, making it impossible for them to dynamically adjust the detection logic according to different attack types, further exacerbating detection bias and reducing detection accuracy.

[0032] Based on this, and to address the problems existing in related technologies, this application provides a network attack detection method. This method employs a two-level detection model working collaboratively. First, a first detection model combined with common first prompt words is used to perform preliminary attack detection on network data, quickly identifying potential attack data. Then, for the attack type determined by the preliminary detection, matching related knowledge is retrieved from a professional knowledge base to construct a dynamic second prompt word containing historical attack cases, attack feature location information, and detection rules. This second prompt word is then input into a second detection model for deep detection. By introducing precise knowledge support from a professional knowledge base, the limitations of large language models' professional knowledge are effectively compensated for, reducing the generation of "knowledge illusions." Simultaneously, the design of dynamically generating prompt words based on attack types makes the detection logic of the detection model more targeted, significantly improving the detection accuracy of different types of attacks and providing more reliable technical support for network security protection.

[0033] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0034] Before introducing the network attack detection method provided in the embodiments of this application, the network attack detection system to which this method is applied will be described first, so as to better understand the application scenario of this method.

[0035] Figure 1 This is a schematic diagram illustrating the structure of a network attack detection system according to an exemplary embodiment of this application. Figure 1 As shown, the network attack detection system includes several network devices 101 and network attack detection devices 102.

[0036] Among them, network devices 101 refer to various devices in the network that may be subject to network attacks. Their specific types can be flexibly configured according to the actual application scenario, and include, but are not limited to, servers, switches, routers, industrial control equipment, IoT terminals, personal computers, and mobile terminals. These network devices 101 generate a large amount of network data during daily operation, covering various information such as data transmission between devices, command interaction, and status feedback. This data is precisely the carrier that network attacks may exist and is also the core analysis object for subsequent detection.

[0037] The network attack detection device 102 maintains a communication connection with each network device 101, and can collect various types of network data generated by each network device 101 in real time. Based on the network attack detection method of this application embodiment, it performs comprehensive analysis and judgment on these data, realizes accurate detection of various network attacks, and provides all-round protection for the safe operation of the network device 101.

[0038] Figure 2 This is a flowchart illustrating a network attack detection method according to an exemplary embodiment of this application. Figure 2As shown, this method can be applied to the network attack detection device 102 mentioned above to achieve accurate detection of various network attacks, specifically including the following steps S201 to S207.

[0039] Step S201: Obtain network data, which is used to characterize the real-time network operating status.

[0040] During network operation, the network attack detection device 102 can collect various network data generated by each network device 101 in real time through communication connections. This network data can effectively reflect the network operating status. Specifically, the network data may include, but is not limited to, network interaction messages, device security logs, and network traffic statistics. Among them, network interaction messages can record in detail the specific content, protocol type, and interaction sequence of data transmission between devices; security logs can completely retain device operation events, user access records, permission change operations, and abnormal behavior trigger information; and traffic statistics can intuitively reflect core network operating characteristics such as network bandwidth usage, data transmission rate, and number of connection sessions.

[0041] To ensure the efficiency and accuracy of subsequent detection processes, in some embodiments, the network attack detection device 102 can perform standardized preprocessing on the network data after acquiring it. For example, it can first parse the network data to extract core metadata such as source IP address, target IP address, communication port number, and protocol type, while extracting key segments from the packet payload and mining temporal features such as connection duration, packet size distribution, and request frequency. Subsequently, the parsed information is structured according to the key-value pair format to remove duplicate fields, invalid and redundant information, and data with incorrect format, unify the data encoding standard, and form standardized network data to provide high-quality data support for the input of subsequent detection models.

[0042] Step S202: Based on network data, construct the first prompt word for the first detection model. The first prompt word includes the role definition of the first detection model, network data, recognition task instructions of the first detection model, and the result output format of the first detection model.

[0043] Step S203: Input the first prompt word into the first detection model to perform preliminary network attack detection on the network data using the first detection model, and output the preliminary detection results; the preliminary detection results are used to preliminarily determine whether the network data has network attack characteristics and the corresponding attack type.

[0044] Step S204: Mark network data that is determined to have network attack characteristics by the preliminary detection results as target network data.

[0045] In network attack detection scenarios, network data volumes are typically large and contain a significant amount of normal data without network attacks. Directly using a single detection model to perform network attack detection on the entire dataset would generate extremely high computational pressure, leading to low detection efficiency and accuracy, making it difficult to meet real-time detection requirements. Therefore, this embodiment adopts a two-tier detection architecture. Two interconnected detection models process network data step-by-step. The first detection model performs preliminary attack detection on the entire dataset, quickly filtering out target network data that may exhibit network attack characteristics. Then, the second detection model performs deep attack detection on the filtered target network data. This achieves a rapid screening and precise verification detection effect, ensuring overall detection efficiency while effectively improving attack detection accuracy.

[0046] To conduct initial attack detection using the first detection model, the primary task is to construct a suitable first prompt word to ensure that the first detection model can clearly identify the detection target, accurately acquire data information, and complete the detection task as required. Specifically, the network attack detection device 102 can construct the first prompt word corresponding to the first detection model based on network data. The first prompt word can include four key components: First, the role definition of the first detection model, which clarifies the model's identity and positioning, such as "You are a professional preliminary network attack detection analyst, responsible for conducting preliminary attack detection on network data and outputting preliminary detection results," enabling the model to conduct detection work from a corresponding professional perspective; Second, the network data, i.e., the network data obtained in step S201, which serves as the core data basis for model detection and must be completely and standardizedly embedded in the prompt word to ensure that the model can fully obtain the basic information required for detection; Third, the detection task instruction of the first detection model, which clearly informs the model of the specific detection task, such as "Please conduct preliminary attack detection on the provided network data, determine whether there are network attack characteristics, and if so, identify the corresponding attack type (such as DDoS attack, SQL injection attack, port scanning attack, etc.)"; Fourth, the result output format of the first detection model, which constrains the model's output content through a standardized format, such as "Output format requirements: 1. Whether network attack characteristics exist: Yes / No; 2. Attack type (if present): XXX," so as to facilitate rapid analysis and processing of the detection results later.

[0047] After constructing the first prompt word, the network attack detection device 102 can input the constructed first prompt word into the first detection model. The first detection model then performs preliminary attack detection on the input network data based on the role positioning and task instructions in the prompt word. Specifically, in this embodiment, the first detection model can be a lightweight model adapted to the preliminary detection scenario. A lightweight model is a model with a relatively small number of parameters (e.g., in the range of millions to tens of millions of parameters). Compared to large models with hundreds of millions or more parameters, it does not require excessive computing and storage resources, and has the advantages of low deployment cost and fast response speed, which can meet the needs of rapid screening of massive network data in the preliminary detection stage. At the same time, through model transfer learning technology, the rich network attack detection knowledge learned by the large model can be transferred to the lightweight model, which can effectively make up for the limited learning ability of the lightweight model itself, significantly improve the accuracy of preliminary detection, and achieve the dual goals of efficient screening and accurate preliminary judgment. During the detection process, the first detection model will combine its own understanding of the characteristics of various network attacks to analyze key information such as metadata and temporal characteristics in the network data, determine whether there are characteristic clues of attack behavior, preliminarily identify possible attack types, and finally output preliminary detection results to determine whether the network data has network attack characteristics and the corresponding attack types.

[0048] Subsequently, the network attack detection device 102 analyzes the preliminary detection results output by the first detection model, marking network data that is determined to "exhibit network attack characteristics" as target network data. This type of target network data is suspected attack data and will enter the subsequent deep detection stage for further verification to ensure the accuracy of attack detection; while network data that is initially determined to "not exhibit network attack characteristics" will not be included in the subsequent deep detection scope, thereby achieving the purpose of rapid screening and focusing on key detection targets.

[0049] However, in real-world detection scenarios, the complexity of network data and the stealth of attack behaviors can lead to misjudgments by the first detection model. Therefore, to improve the reliability of preliminary detection results, in some embodiments, the first detection model outputs a preliminary confidence level along with the preliminary detection result. This confidence level characterizes the model's trust in the preliminary detection result; a higher confidence level indicates stronger reliability. Based on this confidence level, the preliminary detection process can be further optimized: when the preliminary detection result determines that the network data does not exhibit network attack characteristics, and the corresponding preliminary confidence level is less than a first preset threshold (e.g., set to 80%, with the specific value adjustable according to actual detection needs), it indicates that the first detection model has low trust in the detection result and there is a risk of misjudgment. At this point, the network attack detection device 102 can supplement the acquisition with historical network data within the corresponding historical period, such as the same IP interaction records related to the network data within the past 5 minutes, and traffic statistics characteristics within the historical period (such as packet size variance, data request frequency, etc.). Subsequently, the acquired historical network data is fused with the current network data, and the first prompt word is reconstructed based on the fused complete data to ensure that the prompt word contains more comprehensive detection basis. Finally, the reconstructed first prompt word is input again into the first detection model, and the first detection model re-performs preliminary network attack detection on the network data, thereby reducing the probability of false positives and improving the reliability of the preliminary detection results.

[0050] Step S205: Retrieve relevant knowledge matching the attack type corresponding to the target network data from the preset knowledge base.

[0051] After labeling the target network data, this embodiment does not directly perform deep detection on the target network data. Instead, it first retrieves relevant knowledge matching the attack type corresponding to the target network data from a pre-set knowledge base, and then uses this as a basis to advance the subsequent deep detection process. This is done to compensate for the inherent shortcomings of deep detection in related technologies, and to solve the problem of detection limitations caused by relying solely on sample features learned by the model itself for judgment, lacking professional knowledge support. In related technologies, when performing deep detection on suspected attack data, the data is only input into the detection model to complete feature comparison and judgment. The model's analysis logic is completely limited to the sample features learned during the training phase. This not only makes it difficult to accurately identify new and mutated attacks with insufficient sample coverage, but also fails to combine the attack's tactical logic, technical principles, historical cases, and other in-depth information for analysis. It is very easy to make misjudgments due to feature similarity, and at the same time, the judgment of attack behavior lacks professional basis support, which greatly reduces the accuracy and generalization ability of deep detection. This embodiment retrieves and matches related knowledge in advance, which can supplement the subsequent deep detection stage with professional knowledge such as the technical details, judgment rules, and historical cases corresponding to the attack. This provides a more comprehensive and professional basis for judgment in deep detection, which can effectively solve the problem of insufficient detection generalization ability in related technologies. It can also make the judgment logic of deep detection more in line with the professional understanding in the field of network security, further improve the accuracy of identifying complex and new attacks, and reduce the detection bias caused by feature mismatch.

[0052] Specifically, in some embodiments, the pre-defined knowledge base can adopt a hybrid storage mode of "structured data + unstructured data" to comprehensively cover various types of knowledge information related to network attacks, ensuring that the retrieved related knowledge is complete and practical. The structured data mainly covers the knowledge content corresponding to three core databases: the CVE vulnerability database (containing standardized information such as the number, description, scope of impact, and exploitation conditions of various known vulnerabilities), the ATT&CK tactical technology database (systematically summarizing the tactical targets commonly used by attackers, corresponding technical means, and implementation steps), and the attack signature database (storing typical characteristics of various attack behaviors, such as signature codes, abnormal traffic patterns, and specific interactive commands). The unstructured data includes APT attack reports released by security vendors (detailed records of the background, attack path, technical details, and source tracing results of APT attack events), vulnerability exploitation technology white papers (in-depth analysis of the exploitation principles, technical implementation methods, and defense points of various vulnerabilities), and attack and defense exercise case analyses (summarizing the manifestations of attack behaviors, response strategies, and lessons learned in actual attack and defense scenarios).

[0053] Furthermore, to improve the efficiency and accuracy of knowledge retrieval, a knowledge classification index can be established during the construction of the knowledge base. All structured and unstructured data are classified and stored according to a three-level classification dimension: "attack type - attack tactic - attack technique". For example, attack type (such as DDoS attack, SQL injection attack, ransomware attack, etc.) can be used as the primary classification standard to initially categorize various types of knowledge; then, under the same attack type, secondary subdivision can be carried out according to attack tactics (such as initial access, persistence, privilege escalation, data leakage, etc.); finally, under the same tactic dimension, it can be further refined to specific attack techniques (such as remote code execution by exploiting vulnerabilities, brute-force cracking of account passwords, obtaining initial access rights through phishing emails, etc.), forming a hierarchical knowledge classification system.

[0054] Based on the above knowledge base architecture, the specific implementation process of step S205 can be as follows: The network attack detection device 102 first extracts the preliminary attack type corresponding to the target network data (i.e., the attack type output by the first detection model), uses the attack type as the core retrieval condition, and combines it with the three-level classification index to conduct a precise retrieval in the preset knowledge base; during the retrieval process, it matches all structured and unstructured data related to the attack tactics and attack techniques corresponding to the attack type, and finally filters out the related knowledge that can provide support for subsequent in-depth detection, such as the typical technical characteristics, common implementation paths, known vulnerability exploitation conditions, and behavioral performance in historical attack cases corresponding to the attack type.

[0055] Step S206: Based on the associated knowledge, construct the second prompt word of the second detection model. The second prompt word includes the set of historical attack cases in the associated knowledge, the location information of historical network attack features in the associated knowledge, the historical network attack detection rules in the associated knowledge, and the result output format of the second detection model.

[0056] After retrieving relevant knowledge matching the attack type corresponding to the target network data from the knowledge base, a second prompt word adapted to the second detection model can be constructed based on this relevant knowledge, providing targeted input guidance for the subsequent deep detection of the second detection model. It is worth noting that the second prompt word constructed in this embodiment is not a uniform, fixed template style, but is dynamically generated based on the attack type of the target network data obtained from the initial attack detection. That is, different attack types of target network data will generate corresponding exclusive second prompt words adapted to their characteristics. This dynamic generation of prompt words effectively avoids the drawbacks of using fixed prompt word templates to drive model detection in related technologies. In related technologies, fixed prompt word templates cannot adjust the model detection guidance logic according to the differences in attack types. Faced with differences in the core features and judgment points of different attack types, using a uniform expression to guide model detection can easily lead to the model failing to focus on key detection dimensions, thereby exacerbating detection bias and reducing detection accuracy. This embodiment dynamically generates second prompt words adapted to specific attack types, allowing the prompt word content to closely match the characteristics of the target network data to be detected. This accurately guides the second detection model to focus on the core features and key judgment rules of the attack type for in-depth analysis, which not only improves detection efficiency but also significantly enhances the accuracy of in-depth detection, ensuring that the verification results of suspected attack data are more reliable.

[0057] Specifically, the second prompt word constructed based on association knowledge in this embodiment mainly consists of four core elements:

[0058] The first is a collection of historical attack cases within the associated knowledge. This collection consists of typical cases selected from the search results that perfectly match the current attack type. It covers core information such as the attack scenario, implementation steps, key behavioral characteristics, attack chain, and ultimate impact of each case. Incorporating these cases into the second set of prompts helps the second detection model quickly establish an understanding of the current attack type. By comparing the target network data with the features in historical cases, it can more accurately capture attack clues and provide a reference for in-depth judgment.

[0059] Secondly, there is the location information of historical network attack features within the associated knowledge. This information is extracted from the associated knowledge and shows the specific distribution of historical attack features corresponding to the current attack type within the network data. For example, features of a certain type of attack often appear in the payload field of network packets, the "operation type" field of security logs, or the time series of "packet size distribution" in traffic statistics. Clearly defining this location information directly guides the second detection model to focus on core data areas for in-depth analysis, avoiding the inefficient detection caused by indiscriminately traversing the entire network data, while significantly improving the accuracy of feature recognition.

[0060] Thirdly, there are historical network attack detection rules within the associated knowledge base. These rules can originate from standardized detection logic corresponding to the current attack type in structured knowledge bases (such as the ATT&CK tactical and technical database and attack signature database), or they can include empirical detection criteria summarized in unstructured knowledge bases (such as attack and defense exercise case analyses and vulnerability exploitation technology white papers). For example, "When a specific vulnerability exploitation code fragment appears in network data, and the data request frequency exceeds a preset threshold, it can be determined that this type of attack exists." Integrating these rules into the second prompt word can provide clear judgment criteria for the second detection model, standardize its detection logic, and reduce bias caused by subjective judgment of the model.

[0061] Fourthly, the output format of the second detection model. To facilitate the rapid analysis, storage, and application of the deep detection results, a unified output format can be clearly specified in the second prompt. For example, the model may be required to output "Confirm whether network attack characteristics exist: Yes / No", "Attack type (if present): XXX", "Core attack characteristics and corresponding locations: XXX", "Detection basis (related cases / rules): XXX", etc., to ensure the standardization, completeness, and readability of the output results.

[0062] The network attack detection device 102 integrates and sorts out the above four core elements to form a second prompt word that is precisely matched with the current target network data attack type, laying a solid foundation for the second detection model to carry out efficient and accurate in-depth detection.

[0063] Step S207: Input the second prompt word and the target network data into the second detection model to perform deep network attack detection on the target network data using the second detection model, and output the deep detection result; the deep detection result is used to determine whether the target network data has network attack characteristics and the corresponding attack type.

[0064] After constructing the second prompt word, the network attack detection device 102 can input the constructed second prompt word and the marked target network data into the second detection model, which will then perform targeted deep network attack detection. Specifically, in this embodiment, the second detection model can be a medium-sized model. A medium-sized model is one with a parameter count between a lightweight model and a large model (e.g., a parameter count in the tens of millions to hundreds of millions). Compared to a lightweight model, it has stronger feature learning and deep analysis capabilities, enabling it to uncover hidden deep attack features in the target network data and analyze the logical links of attack behaviors. Compared to a large model, it does not require excessive computing and storage resources, making deployment costs more controllable. It also has a faster response speed, ensuring both deep detection accuracy and detection efficiency, thus meeting the core requirement of accurate verification in a two-level detection architecture.

[0065] During the detection process, the second detection model first establishes a deep cognitive framework for the attack type corresponding to the current target network data based on the historical attack case set, attack feature location information, and attack detection rules in the second prompt. Then, it focuses on the core areas of the target network data, performing a dimension-by-dimensional comparative analysis of the target network data's features and the associated knowledge in the prompt. For example, based on the explicitly stated attack feature location information in the prompt, the model accurately locates the corresponding fields in the target network data and checks for content matching historical attack features. Simultaneously, it combines the detection rules in the prompt to determine whether the characteristics of the target network data meet the attack judgment conditions and, referring to the behavioral patterns of historical attack cases, verifies whether the behavioral logic in the target network data matches the attack behavior. Finally, the second detection model outputs a deep detection result, which accurately determines whether the target network data indeed contains network attack features and the corresponding precise attack type, providing a core basis for the final handling of network attacks.

[0066] Similarly, to further ensure the reliability of depth detection results, in some embodiments, the second detection model outputs the depth confidence level corresponding to the depth detection result at the same time as outputting the depth detection result. The confidence level is used to characterize the degree of trust that the model has in the preliminary detection result. The higher the confidence level, the stronger the reliability of the detection result.

[0067] Based on this depth confidence level, this embodiment also sets up a complete supplementary detection and result confirmation process: when the depth confidence level output by the second detection model is greater than or equal to the second preset threshold, it indicates that the model has a high enough level of confidence in the current depth detection result, and the reliability of the detection result can be guaranteed. At this time, the depth detection result is directly confirmed as the final detection result, and there is no need to start the subsequent supplementary detection process. The network attack detection device 102 can synchronize the final detection result (including whether there is a network attack, the corresponding attack type, etc.) to the network security management platform, and trigger the corresponding handling response mechanism. For example, if it is determined that there is a network attack, it will automatically match the defense strategy (such as blocking attack traffic, blocking attack IPs, isolating affected devices, etc.) according to the attack type to achieve rapid response and handling of the attack; if it is determined that there is no network attack, the "suspected attack" mark of the target network data will be removed, and it will be included in the normal network data management scope. When the depth confidence level output by the second detection model is less than the second preset threshold (for example, it can be set to 90%, and the specific value can be adjusted according to the actual detection needs), it indicates that the model has a low level of confidence in the current depth detection result, and there is a risk of judgment deviation. At this point, the network attack detection device 102 can initiate a multi-model collaborative verification process, calling at least two different recognition models of the same scale as the second detection model. These different recognition models can have different model structures and feature learning focuses (for example, some models focus on temporal feature analysis, while others focus on text feature extraction), which can perform a deeper detection of the target network data from multiple perspectives, avoiding misjudgments caused by the cognitive limitations of a single model. After multi-model detection is completed, the network attack detection device 102 will perform a consistency comparison of the deep detection results output by each model: if the deep detection results output by all different identification models are consistent with the deep detection results output by the second detection model (i.e., the judgment conclusion and attack type are exactly the same), it means that even if the confidence of a single model is low, the multi-model collaborative verification supports the result, and the deep detection result can be confirmed as the final detection result. The corresponding result synchronization and processing procedures mentioned above can then be executed. If the deep detection result output by any different identification model differs from the deep detection result output by the second detection model (for example, the second detection model determines that "a certain type of attack exists," while a different identification model determines that "no attack exists," or the attack types determined by the two are different), it means that the current detection result is controversial and needs to be further verified. At this time, the network attack detection device 102 can automatically trigger the manual review process, and fully synchronize the target network data, the detection results of the second detection model, the detection results of different identification models, the corresponding confidence levels, the related knowledge retrieval results and other relevant information to the operation terminal of the security operation and maintenance personnel. The professional operation and maintenance personnel will then conduct manual analysis based on their own experience and professional knowledge to finally determine whether the target network data is subject to a network attack and the corresponding attack type.The conclusions drawn from manual review will serve as the final test results, which will then be synchronized to the management platform and appropriate actions will be taken to ensure the accuracy and authority of the test results and minimize the risk of misjudgment or omission.

[0068] Building upon the above embodiments, and considering the dynamic evolution of network attack methods and the continuous emergence of new attack characteristics, a fixed static knowledge base cannot adapt to these changes in real time, potentially leading to a lag in the identification of new attacks. Furthermore, if errors are found in the deep detection results during manual review, the knowledge base needs to be corrected promptly to avoid subsequent misjudgments. Therefore, in some embodiments, a closed-loop knowledge update mechanism can be constructed to achieve dynamic iterative optimization of the knowledge base.

[0069] Specifically, when the deep detection result determines that the target network data contains network attack characteristics, but the matching degree between the network attack characteristics of the target network data and the historical network attack characteristics stored in the knowledge base is less than a preset matching threshold (e.g., 60%, which is considered a discovery of a new attack characteristic), or when the network attack detection device 102 receives feedback from human intervention that the deep detection result is incorrect, the knowledge update process will be automatically triggered. First, the network attack detection device 102 extracts the core network attack characteristics from the target network data. Then, it standardizes the extracted attack characteristics to generate standardized network attack characteristics that include attack type, attack characteristic description, attack detection logic, and attack detection basis, and assigns a unique ID to each to ensure the uniqueness of the identifier. After standardization, the network attack detection device 102 can push the standardized network attack characteristics to the knowledge management platform for manual review. After the review is approved, it is synchronously updated to the structured feature library and vector database of the knowledge base, and a corresponding update log is generated, recording information such as the feature entry time, reviewer, and related cases. Meanwhile, in order to allow the detection model to adapt to the new knowledge in a timely manner, the first and second detection models can be incrementally learned and fine-tuned using newly added feature samples within a certain period (such as monthly) to improve the model's ability to identify new attack features.

[0070] At the prompt word construction level, to avoid excessive imperative descriptions interfering with the model's professional judgment and to improve the professionalism and reliability of the model's reasoning, some embodiments may employ a minimum instruction strategy to optimize the prompt word structure. Specifically, when constructing the second prompt word, the proportion of imperative descriptions can be strictly controlled (e.g., its proportion ≤30%), while the proportion of knowledge base references can be significantly increased. This allows the second detection model to rely more on retrieved professional knowledge rather than general instructions during the reasoning process, thereby weakening the interference of subjective imperative descriptions on the model's judgment and making the deep detection results output by the model more professional and accurate.

[0071] Furthermore, in actual network attack detection processes, when retrieving related knowledge for target network data, knowledge corresponding to certain attack types is repeatedly retrieved and used. Multiple retrievals from the knowledge base consume significant computing resources, prolong retrieval time, and negatively impact overall detection efficiency. Therefore, in some embodiments, a caching mechanism can be implemented to optimize the knowledge retrieval process and improve retrieval efficiency. Specifically, the network attack detection device 102 can statistically analyze the historical access frequency of each piece of knowledge in the knowledge base, identifying knowledge with a historical access frequency exceeding a preset frequency threshold as high-frequency knowledge. This high-frequency knowledge is then stored in a preset cache module. When performing subsequent network attack detection and retrieving related knowledge from the knowledge base, high-frequency knowledge is retrieved first from this cache module, eliminating the need to repeatedly access the original knowledge base. This effectively reduces resource consumption from repeated retrievals and significantly shortens the knowledge retrieval time.

[0072] Meanwhile, in some embodiments, in order to adapt to the detection needs of massive network data and ensure the stable progress of the detection process, dynamic resource scheduling can also be performed. Specifically, the network attack detection device 102 monitors the current network traffic load in real time and dynamically adjusts the concurrency of the first detection model and the second detection model according to the real-time load. When the traffic peak exceeds the preset threshold, some preliminary attack detection tasks are automatically diverted to the regional layer server to avoid overload and lag of the detection device on a single node, ensuring that the entire detection process can proceed efficiently and stably.

[0073] The network attack detection method based on the above embodiments can accurately determine whether target network data has network attack characteristics and corresponding attack types. However, in actual network security protection work, simply completing attack detection is insufficient to support subsequent emergency response and responsibility determination. After identifying an attack, it is necessary to further verify the authenticity of the attack, trace the attack path, and secure attack evidence to provide a strong basis for attack handling and responsibility allocation. Therefore, in some embodiments, source tracing and evidence collection-related technical solutions can be added. By constructing a network attack detection system that includes source tracing and evidence collection devices, a closed-loop management system covering the entire chain from attack detection to source tracing and evidence collection can be achieved. The following section will describe in detail the source tracing and evidence collection process of the source tracing and evidence collection device in conjunction with the system structure and method flow, in order to achieve the core objectives of securing attack evidence, tracing attack paths, and identifying potential risks.

[0074] Figure 3 This is a schematic diagram illustrating the structure of another network attack detection system according to an exemplary embodiment of this application. Figure 3 As shown, the network attack detection system includes several network devices 101, network attack detection devices 102, and source tracing and evidence collection devices 103.

[0075] The network device 101 and the network attack detection device 102 can be referred to in the description of the network attack detection system above, and will not be repeated here.

[0076] Based on the network attack detection method of the above embodiment, after determining the network data with network attack characteristics and its corresponding attack type, the network attack detection device 102 can further extract network attack data that can characterize the current network attack attributes, and then synchronize the data to the source tracing and evidence collection device 103, which will then carry out source tracing and evidence collection work based on this data.

[0077] The source tracing and evidence collection device 103 is communicatively connected to both the network device 101 and the network attack detection device 102. Its deployment method can be flexibly selected according to actual application needs. It can be directly integrated into the network attack detection device 102 to achieve integrated detection and evidence collection, or it can be independently deployed and integrated into other network devices such as preset servers, cloud computing devices, or dedicated security devices to meet the application needs of distributed network environments. This source tracing and evidence collection device 103 can acquire network attack data determined by the network attack detection device 102 in real time and perform source tracing and evidence collection based on the source tracing and evidence collection method provided in the following embodiments. The final output includes source tracing and evidence collection results, including verification of whether network attack characteristics truly exist, determination of whether the attacked device has potential network attack characteristics and corresponding attack types, tracing the attack path of the network attack, and all evidence supporting the above results. This provides a strong basis for network security emergency response and responsibility determination.

[0078] Figure 4 This is a flowchart illustrating a source tracing and evidence collection method according to an exemplary embodiment of this application. Figure 4 As shown, the method can be applied to the above-mentioned traceability and evidence collection device 103, including the following steps S401 to S406.

[0079] Step S401: Obtain network attack data, which is data that has been pre-determined to have network attack characteristics and can characterize the attributes of the current network attack.

[0080] Network attack data is the fundamental input for attribution investigation and forensics. It comprehensively covers various attributes of current network attacks, ensuring sufficient data support for subsequent analysis. Specific types of data include, but are not limited to, the IP address of the attacked device, the name of the network attack, the type of the network attack, the corresponding payload information, and the network context messages at the time of the attack. Specifically, the IP address of the attacked device is used to accurately locate the target of the attack, providing a clear direction for subsequent tool deployment and information collection; the attack name and attack type can quickly identify the core characteristics of the attack (such as "SQL injection attack," "ransomware attack," etc.), providing a basis for matching historical forensic experience and determining information collection strategies; the payload information corresponding to the attack contains key content such as malicious code fragments and command data carried by the attack behavior, serving as important clues for identifying attack intent; and the network context messages record the network interaction environment at the time of the attack, covering information such as the communication sequence, protocol type, and data transmission content between the attacker and the attacked device, enabling the reconstruction of the network scenario at the time of the attack.

[0081] Specifically, the method of acquiring network attack data can be flexibly configured according to the actual application scenario. Either the network attack detection devices 102 can automatically transmit the extracted network attack data to the source tracing and evidence collection device 103 through a preset communication interface after detecting a network attack, or in special scenarios (such as when the network attack detection devices 102 are not fully adapted to the automatic transmission function), staff can enter the confirmed network attack data through the manual input interface of the source tracing and evidence collection device 103 to ensure that the source tracing and evidence collection device 103 can obtain valid data in a timely manner and start the subsequent source tracing and evidence collection process.

[0082] Step S402: Retrieve information collection association knowledge that matches the attack type corresponding to the network attack data from the preset knowledge base. The information collection association knowledge includes: historical information collection dimensions and historical information collection tools for historically attacked devices in historical tracing and forensic cases that match the attack type.

[0083] Step S403: Using a pre-defined large model, based on network attack data and information gathering knowledge, determine the information gathering dimensions and information gathering tools of the currently attacked device pointed to by the network attack data.

[0084] Step S404: Push the information collection tool to the attacked device so that the attacked device runs the information collection tool according to the information collection dimension to collect the device information of the attacked device. The device information can characterize the operating status of the attacked device under network attack.

[0085] After obtaining network attack data, directly using this data for subsequent source tracing and forensics can only reconstruct the transmission path and interaction process of the network attack at the network level. It cannot delve into the internal damage state of the attacked device, accurately determine the actual extent of damage caused, or verify whether the exploited vulnerabilities have been patched, ultimately leading to significant limitations in the source tracing and forensics results. Therefore, targeted device-side information collection is necessary to supplement the operational data and status information of the attacked device to achieve comprehensive and in-depth source tracing and forensics. To efficiently collect device-side information, it is first necessary to determine the information collection dimensions and tools suitable for the current attack type. Ignoring the differences in attack types and applying a fixed information collection strategy to all attack scenarios will not only result in incomplete collection of key information due to insufficient strategy targeting but may also lead to the acquisition of a large amount of redundant data unrelated to source tracing and forensics, wasting resources and reducing efficiency. Therefore, this embodiment proposes a scheme to formulate differentiated information collection strategies for attacked devices based on different attack types.

[0086] To quickly determine an accurate information collection strategy, the most direct and effective approach is to draw on successful experiences in historical source tracing and forensics. Therefore, after acquiring network attack data, the source tracing and forensics device 103 can first search a pre-built knowledge base for information collection related knowledge that matches the current attack type. This knowledge base is a pre-built knowledge reserve for network attack source tracing and forensics, containing a massive amount of categorized and organized historical source tracing and forensics case data. It covers various common attack types such as SQL injection attacks, ransomware attacks, DDoS attacks, and cross-site scripting attacks, as well as handling cases for some new and rare attacks. Each case is associated with a complete handling plan for the corresponding attack type, including historical information collection dimensions and tools for different historically attacked devices. At the same time, this knowledge base supports dynamic updates based on new source tracing and forensics cases and technical experience, ensuring the timeliness and comprehensiveness of its knowledge reserves. In a specific search, the source tracing and evidence collection device 103 can first extract key feature fields from the acquired network attack data, namely the attack type of the current network attack, and then use the attack type as the search keyword to perform a precise matching search in the knowledge base, filter out historical source tracing and evidence collection cases that are consistent with or highly similar to the current attack type, and then extract the corresponding information collection association knowledge in these cases to provide experience support for determining the information collection strategy of the current attacked device.

[0087] Based on the information collection and related knowledge obtained from the retrieval, the source tracing and evidence collection device 103 can determine the information collection dimensions and tools suitable for the currently attacked device through a preset large model. This large model is an intelligent decision-making model pre-trained based on deep learning algorithms, which has the ability to perform attack type matching analysis, historical experience transfer, and tool dimension adaptation. Specifically, if the knowledge base contains information collection association knowledge that precisely matches the attack type of the current network attack data, the big model directly transfers and determines the historical information collection dimensions and tools for historically attacked devices from this association knowledge as the information collection dimensions and tools corresponding to the current attacked device. This enables the reuse of past successful experiences and improves the efficiency and accuracy of information collection strategy formulation. If the knowledge base does not contain information collection association knowledge that matches the current attack type, i.e., the current attack type is a new or rare attack, the big model automatically calls the preset tool library and determines all information collection tools stored in the tool library as the information collection tools required for this forensics. At the same time, it determines all information collection dimensions that these tools can cover as the information collection dimensions for this forensics, thereby ensuring that there are no blind spots in the information collection of new attacks and avoiding the omission of key information due to lack of experience. The information collection tools include mainstream information collection tools such as osquery, Fenrir, and LinPEAS, which can respectively realize information collection functions of different dimensions such as system configuration query, malicious code scanning, and privilege escalation vulnerability detection.

[0088] After determining the information collection dimensions and tools, the forensic tracing device 103, based on the determined information collection tools, can push the corresponding toolkit to the currently attacked device through a preset secure communication channel, and simultaneously issue information collection dimension instructions matching the tools. Compared to the active detection method in related technologies, this embodiment allows the attacked device to autonomously run and collect data after receiving the toolkit, effectively avoiding the problem of evidence collection interruption caused by external active scanning being mistakenly judged as malicious activity by network security devices. After receiving the toolkit and instructions, the attacked device automatically runs the information collection tools according to the preset information collection dimensions to carry out comprehensive device information collection. The collected device information can comprehensively characterize the real-time operating status of the attacked device during the network attack, specifically including but not limited to the attacked device's device configuration information, process running information, operation logs, and temporary files generated during the network attack. Among them, device configuration information can reflect the device's system version, software and hardware environment, and security policy configuration, providing a basis for analyzing attack vulnerabilities; process running information can present the device's process startup and running status when the attack occurs, making it easier to identify malicious processes; operation logs can completely record user operation behaviors and system events before and after the attack; and temporary files generated during the attack may contain core forensic clues such as malicious code residues and attack command fragments, providing key support for subsequent source tracing analysis.

[0089] Step S405: Retrieve source tracing and forensic knowledge that matches the device information from the knowledge base. Source tracing and forensic knowledge includes: historical device information in historical source tracing and forensic cases that match the device information, as well as historical network attack data and historical source tracing and forensic results corresponding to the historical device information.

[0090] Step S406: Using the large model, based on device information, source tracing and evidence collection related knowledge, and network attack data, output source tracing and evidence collection results. The source tracing and evidence collection results include: verification results to verify whether the network attack characteristics of the network attack data actually exist; judgment results to determine whether there are potential network attack characteristics on the attacked device and the attack type corresponding to the potential network attack characteristics; source tracing results to trace the attack path of the network attack; and evidence for the verification results, judgment results, and source tracing results respectively.

[0091] After collecting device information of the attacked device, directly relying on a large model to analyze scattered network attack data and device information is prone to analytical bias due to a lack of historical experience for reference, and may even lead to a "large model illusion," resulting in a lack of credibility and rigor in the output forensic results. Therefore, similar to the information collection strategy determined earlier, this embodiment can still choose to reuse historical source tracing and forensic experience to provide a reliable reference for in-depth analysis of the large model, thereby improving the accuracy and effectiveness of the forensic results. That is, the source tracing and forensic device 103 searches the preset knowledge base for source tracing and forensic related knowledge that matches the currently collected device information. In the specific search process, the source tracing and forensic device 103 can first extract core features from the collected device information, such as device configuration features, process abnormal features, log key event features, and malicious code features in temporary files, and then use these features as search conditions to perform multi-dimensional matching searches in the knowledge base, and filter out historical source tracing and forensic cases that highly match the features of the current device information. The extracted knowledge related to source tracing and evidence collection not only includes historical device information that matches the current device information in the case, but also covers historical network attack data corresponding to the historical device information, as well as complete historical source tracing and evidence collection results derived from the analysis of both, forming a complete experience chain from data input to result output, providing comprehensive reference support for subsequent large-scale model analysis.

[0092] Based on the acquired current device information, network attack data, and retrieved source tracing and forensic knowledge, the source tracing and forensic device 103 can utilize a pre-set large model to comprehensively analyze multi-dimensional data and ultimately output comprehensive and accurate source tracing and forensic results. During the analysis, the large model first compares the current network attack data with historical network attack data, combining this with the device operating status recorded in the current device information during the attack period to verify whether the network attack features in the network attack data truly exist and act on the attacked device, forming corresponding verification results. Secondly, relying on the experience in identifying potential attack features summarized from historical cases, the large model deeply mines the current device information to determine whether there are potential network attack features in the attacked device that were not captured by the initial network attack data, and further determines the attack type corresponding to these potential features, forming a judgment result. Simultaneously, the large model combines the attack transmission path information in the network attack data, the process and log records in the device information, and the attack path tracing experience from historical cases to reconstruct the complete attack path from the initiator to the attacked device, forming a source tracing result. To ensure the traceability and legal validity of the evidence, the large model generates corresponding evidence chains simultaneously while outputting the above three types of results. Evidence for verification results can include feature comparison reports of network attack data and device information; evidence for judgment results can include records of extraction and analysis of potential attack features; and evidence for source tracing results can include interactive data and log evidence from each node in the attack path, thus achieving closed-loop management of source tracing and evidence collection.

[0093] However, in actual forensic investigations, the device information collected from attacked devices often contains a large amount of scattered and independent raw data. Directly inputting this data into a large model for analysis not only increases the computational burden on the model and reduces analysis efficiency, but also may prevent the model from accurately capturing key features due to a lack of clear logical connections between the data, thus affecting the accuracy of the forensic investigation results. Therefore, in some embodiments, before using a large model for forensic investigation analysis, the collected device information can be structured to build logical connections between the data, improving the efficiency and accuracy of subsequent analysis.

[0094] Specifically, the source tracing and evidence collection device 103 can perform structured processing of device information through the relationships between various historical device information pre-stored in the knowledge base. These relationships are the inherent logic of device information extracted and summarized from massive historical source tracing and evidence collection cases, covering correspondences of multiple data dimensions, including but not limited to the relationship between process running information and operation logs, and the relationship between file information and network transmission traffic. Among them, the relationship between process running information and operation logs can reflect the matching of the time nodes of a specific process's start, run, and termination with the corresponding event records in the system operation log. For example, the start of a malicious process is often accompanied by the generation of operation logs such as system permission changes and file read / write operations. The relationship between file information and network transmission traffic can establish a corresponding link between newly added, modified, and deleted file data within the device and the transmission traffic of a specific IP and port during a network attack. For example, malicious temporary files generated during an attack usually have temporal and content correlations with the file transmission traffic of external attack sources.

[0095] During structured processing, the source tracing and evidence collection device 103 can first retrieve the aforementioned preset association rules from the knowledge base, and then use these rules as a basis to classify, match, and integrate the collected raw device information. For example, the process ID, startup time, and running path in the process running information are associated and bound with the permission change records and file access records within the same time interval in the operation log; the generation time and file hash value of temporary files are matched and associated with the transmission traffic characteristics of the corresponding time period in the network attack data. Finally, the originally scattered device configuration information, process running information, operation logs, temporary files, and other data are transformed into structured data with clear logical relationships. The device information after structured processing can clearly present the inherent connections between data, greatly reducing the analysis difficulty of large models, and at the same time providing a more solid data foundation for subsequent in-depth analysis based on device information, source tracing and evidence collection association knowledge, and network attack data.

[0096] In addition, to ensure the reliability and practicality of the traceability and evidence collection results, avoid invalid evidence collection conclusions due to analytical bias, and improve the closed-loop management level of traceability and evidence collection work, in some embodiments, the traceability and evidence collection device 103 can also conduct further security assessments on the traceability and evidence collection results after obtaining them.

[0097] Specifically, after outputting the source tracing and evidence collection results through the large model, the source tracing and evidence collection device 103 can call a preset security assessment model to perform a security assessment on the results. The security assessment model can be trained based on a massive number of historical valid evidence collection cases and has built-in multi-dimensional preset security assessment standards, such as: the completeness of the evidence chain of the verification results, the accuracy of identifying potential attack features of the judgment results, the logical coherence of the attack path of the source tracing results, and the correlation between the evidence and data corresponding to various results. During the assessment process, if the source tracing and evidence collection results meet the preset security assessment standards, that is, all assessment dimensions meet the standards, it indicates that the results have sufficient rigor and credibility. At this time, a formal source tracing and evidence collection report will be generated based on the source tracing and evidence collection results. The report not only comprehensively covers the verification results, judgment results, source tracing results, and corresponding complete evidence, but also deeply analyzes the severity of the cyberattack based on the source tracing results. For example, it classifies the severity level according to the importance of the attacked device, the scope of system function impact caused by the attack, and the risk of data leakage. It also provides targeted security protection recommendations, such as patch solutions for the vulnerabilities exploited by the attack, optimization of network access control policies for the attack path, and strengthening of real-time device monitoring rules for potential attack characteristics. If the source tracing results do not meet the preset security assessment standards, such as broken evidence chains, logical contradictions in the attack path, or doubts about the identification of potential attack characteristics, it indicates that the current source tracing has deficiencies. The entire source tracing method described above needs to be re-executed, from acquiring cyberattack data and collecting device information to retrieving source-related knowledge and conducting large-scale model analysis, to correct any deviations. The re-execution process will continue until the output traceability and evidence collection results meet the preset security assessment standards. If the number of re-executions reaches the preset maximum number of executions and no results that meet the standards are obtained, an alarm mechanism will be triggered to prompt staff to intervene for manual verification and handling, so as to ensure that the traceability and evidence collection work is not interrupted and no key risks are overlooked.

[0098] Corresponding to the embodiments of the aforementioned network attack detection methods, this application also provides a network attack detection device, including a memory, a processor, and a computer program stored in the memory and executable on the processor; wherein, when the processor executes the computer program, it implements the steps of the network attack detection method described in any of the above embodiments.

[0099] For example, processors include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), application-specific integrated circuits (ASICs), or field-programmable gate arrays (FPGAs).

[0100] For example, the memory may include at least one type of storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc.

[0101] Figure 5 This is a schematic diagram illustrating the structure of a network attack detection device 102 according to an exemplary embodiment of this application. Figure 5 As shown, at the hardware level, the network attack detection device 102 includes a processor 501, an internal bus 502, a network interface 503, memory 504, and non-volatile memory 505, and may also include other hardware required for services. One or more embodiments of this application can be implemented in software, for example, the processor 501 reads the corresponding computer program from the non-volatile memory 505 into the memory 504 and then runs it. Of course, in addition to software implementation, one or more embodiments of this application do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the above processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0102] Corresponding to the embodiments of the aforementioned network attack detection methods, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network attack detection method described in any of the above embodiments.

[0103] Corresponding to the embodiments of the aforementioned network attack detection method, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network attack detection method described in any of the above embodiments.

[0104] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention filed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the foregoing claims.

[0106] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

[0107] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting network attacks, characterized in that, include: Acquire network data, which is used to characterize the real-time network operating status; Based on the network data, a first prompt word for the first detection model is constructed. The first prompt word includes the role definition of the first detection model, the network data, the recognition task instructions of the first detection model, and the result output format of the first detection model. The first prompt word is input into the first detection model to perform preliminary network attack detection on the network data and output preliminary detection results; the preliminary detection results are used to preliminarily determine whether the network data has network attack characteristics and the corresponding attack type. Network data that is determined by the preliminary detection results to have network attack characteristics is marked as target network data; Retrieve relevant knowledge matching the attack type corresponding to the target network data from a preset knowledge base; Based on the associated knowledge, a second prompt word is constructed for the second detection model. The second prompt word includes the set of historical attack cases in the associated knowledge, the location information of historical network attack features in the associated knowledge, the historical network attack detection rules in the associated knowledge, and the result output format of the second detection model. The second prompt word and the target network data are input into the second detection model to perform deep network attack detection on the target network data and output the deep detection result; the deep detection result is used to determine whether the target network data has network attack characteristics and the corresponding attack type.

2. The method according to claim 1, characterized in that, The knowledge base stores structured and unstructured data; the structured data includes knowledge corresponding to the CVE vulnerability database, ATT&CK tactical and technical database, and attack signature database, while the unstructured data includes knowledge corresponding to security vendor APT attack reports, vulnerability exploitation technology white papers, and attack and defense exercise case analyses.

3. The method according to claim 2, characterized in that, The structured and unstructured data in the knowledge base are classified and stored according to a three-level classification dimension: attack type, attack tactics, and attack techniques.

4. The method according to claim 1, characterized in that, The first detection model is also used to output the preliminary confidence level corresponding to the preliminary detection result; The method further includes: When the preliminary detection result determines that the network data does not have network attack characteristics and the preliminary confidence level is less than the first preset threshold, the historical network data within the historical period corresponding to the network data is obtained, and the first prompt word is reconstructed based on the historical network data and the network data. The reconstructed first prompt word is input into the first detection model to perform preliminary network attack detection on the network data again using the first detection model.

5. The method according to claim 1, characterized in that, The second detection model is also used to output the depth confidence level corresponding to the depth detection result; The method further includes: When the depth confidence is less than the second preset threshold, at least two different recognition models of the same scale as the second detection model are invoked to perform deep network attack detection on the target network data respectively. If the depth detection result output by any of the different recognition models differs from the depth detection result output by the second detection model, a manual review process is triggered.

6. The method according to claim 1, characterized in that, The method further includes: When the deep detection result determines that the target network data has network attack characteristics, and the matching degree between the network attack characteristics of the target network data and the historical network attack characteristics stored in the knowledge base is less than a preset matching threshold, and / or when a human opinion is received that the deep detection result is incorrect, the network attack characteristics of the target network data are extracted. The network attack characteristics of the target network data are standardized to obtain standardized network attack characteristics, including attack type, attack characteristic description, attack detection logic, and attack detection basis. The standardized network attack characteristics are updated in the knowledge base.

7. The method according to claim 1, characterized in that, The method further includes: Knowledge in the knowledge base whose historical access frequency is higher than a preset frequency threshold is identified as high-frequency knowledge. The high-frequency knowledge is stored in a preset cache module so that the high-frequency knowledge in the cache module can be retrieved first during subsequent network attack detection.

8. A network attack detection system, characterized in that, include: Several network devices, wherein the network devices are devices in the network that may be subject to network attacks; A network attack detection device, communicatively connected to the network device, is used to execute the network attack detection method according to any one of claims 1 to 7.

9. A network attack detection device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the network attack detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network attack detection method according to any one of claims 1 to 7.

Images