Network security protection report text generation method and device, medium and product

Abstract

The invention discloses a network security protection report text generation method and device, a medium and a product, and relates to the field of network security and large language models.The method comprises the steps that LoRA increment pre-training and LoRA instruction fine tuning are carried out based on a base large model, and a final version large model is obtained; obtaining user input, and determining the type of the user input; and determining a dialogue template based on the type input by the user, performing reasoning by adopting the final version model, and generating a network security protection report text. The application focuses on the actual demand of network security and other security report content generation, and provides a new solution thought for performing field fine tuning on the general large model, so as to solve the problem that the existing general model has obvious insufficiency in normative content generation and presentation in the aspect of network security and other security.

Description

Technical Field

[0001] This application relates to the fields of network security and large language models, and in particular to a method, device, medium, and product for generating network security compliance report text. Background Technology

[0002] With the rapid advancement of information system digitization, cybersecurity has become a crucial guarantee for the stable operation of information infrastructure and socio-economic systems. As cyberattack methods continue to evolve, effectively assessing and improving the security protection level of information systems has become a critical issue that urgently needs to be addressed. Cybersecurity assessment is not only an important means of identifying system security vulnerabilities and weaknesses, but also a key step in verifying whether information systems comply with relevant laws, regulations, and technical standards. Current assessment processes typically require the writing of numerous compliance documents, the most representative of which is the Cybersecurity Classified Protection Assessment Report (referred to as the Cybersecurity Classified Protection Report). This report needs to comprehensively cover the system's current security status, assessment records, and rectification suggestions. Its writing process is highly dependent on professionals, not only time-consuming and labor-intensive, but also easily affected by differences in experience and expression, making it difficult to guarantee the completeness, accuracy, and standardization of the content. Meanwhile, in recent years, large language models, represented by the Transformer architecture, have shown broad application prospects in the cybersecurity field due to their powerful natural language understanding and generation capabilities. Current research focuses on intrusion detection (such as malicious traffic identification based on large models), code auditing (such as automated vulnerability discovery), and security assessment (such as risk level prediction), and has achieved a series of breakthroughs. However, it is worth noting that there is no dedicated large-scale model application research for the text generation task of cybersecurity compliance reports, which has strong domain-specific and normative characteristics, and the existing general models still have significant shortcomings in generating normative content in cybersecurity compliance. Summary of the Invention

[0003] To address the aforementioned problems in the existing technology, this application provides a method, device, medium, and product for generating network security compliance report text.

[0004] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for generating a network security compliance report text, including: Based on the base model, LoRA incremental pre-training and LoRA instruction fine-tuning were carried out to obtain the final version of the large model. Obtain user input and determine the type of the user input; Based on the type of user input, a dialogue template is determined, and the final version of the large model is used for reasoning to generate a network security compliance report text.

[0005] Optionally, LoRA incremental pre-training and LoRA instruction fine-tuning are performed based on the base large model to obtain the final version of the large model, including: Construct an incremental pre-training dataset and perform LoRA incremental pre-training on the base model until the first set condition is met to obtain the cybersecurity knowledge model. Obtain the historical cybersecurity compliance report and related standard content, and convert them into a structured form to obtain structured data; Using the aforementioned cybersecurity knowledge model, the structured data is scored for writing standardization, and samples with scores less than or equal to a set threshold are filtered out to obtain the remaining samples. Based on the remaining samples, an instruction fine-tuning dataset is generated, and the inputs and outputs in the instruction fine-tuning dataset are embedded into a heterogeneous dialogue template that is different from the native dialogue template of the base model to generate a dialogue dataset. The dataset is divided into a training set, a validation set, and a test set. After fine-tuning the cybersecurity knowledge model using the training set and the validation set with LoRA instructions, the fine-tuned cybersecurity knowledge model is evaluated using the test set to obtain the evaluation results. Based on the evaluation results, the hyperparameters of the cybersecurity knowledge model are tuned until the indicators of the tuned cybersecurity knowledge model meet the second set condition, thus obtaining the final version of the model.

[0006] Optionally, during the LoRA incremental pre-training process for the large base model, the optimization objective function used is: ; In the formula, Φ represents the optimization parameters of the large-scale base model. For multi-task learners, These are the input and output of the large base model, respectively. For the output sequence y At any moment t The label to be predicted, For the training dataset used for incremental pre-training, This is the index of the current time step or position in the output sequence.

[0007] Optionally, obtain the network security historical compliance report and related standard content, and convert them into a structured form to obtain structured data, including: The target content is extracted from the network security historical compliance report and the standard content related to the network security historical compliance report using an automated program. The extracted target content is stored in a CSV file to obtain the structured data.

[0008] Optionally, the heterogeneous dialogue template refers to a template that organizes instructions, inputs and expected outputs in a fixed format.

[0009] Optionally, during LoRA incremental pre-training and LoRA instruction fine-tuning, the LoRA rank is 32, the learning rate ranges from 5e-5 to 5e-6, the batch size ranges from 8 to 32, and the optimizer uses adamw_torch.

[0010] Optionally, determining a dialogue template based on the type of user input includes: When the user input is of the type of general task, the dialogue template adopts the native dialogue template of the base model; When the user input type is a network security level protection report content generation task, the dialogue template adopts the heterogeneous dialogue template.

[0011] Secondly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the network security compliance report text generation method provided above.

[0012] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network security compliance report text generation method described above.

[0013] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network security compliance report text generation method described above.

[0014] According to the specific embodiments provided in this application, this application has the following technical effects: This application provides a method, device, medium, and product for generating cybersecurity compliance reports. By focusing on the actual needs of generating cybersecurity compliance report content, it proposes a solution of domain-specific fine-tuning of a general-purpose large model. It uses the final version of the large model obtained by performing LoRA incremental pre-training and LoRA instruction fine-tuning based on the base large model for inference to generate cybersecurity compliance report text. This can solve the problem that the existing general-purpose model has significant shortcomings in generating normative content in cybersecurity compliance, thus providing a feasible path for the application of large models in the cybersecurity field and providing a reference for compliance document generation tasks in other fields. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A flowchart illustrating a method for generating a network security compliance report text according to an embodiment of this application; Figure 2 This is a schematic diagram of the LoRA principle provided in one embodiment of this application; Figure 3 A schematic diagram of the implementation architecture of a network security compliance report text generation method provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] Cybersecurity compliance reports have extremely high requirements for standardization, but the traditional manual drafting method is not only time-consuming and labor-intensive, but also prone to oversights due to human factors. Large-scale models, with their powerful text generation capabilities, offer a technological solution to this pain point; however, there are currently no large-scale models specifically designed for generating compliance reports. Therefore, applying large-scale models to the generation of compliance report text is an innovative and practical research direction. To address this issue, this application provides a method, device, medium, and product for generating cybersecurity compliance report text.

[0019] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] In one exemplary embodiment, this application provides a method for generating network security compliance report text. This method is executed by a computer device, specifically by a terminal or server alone, or by both. In this embodiment, the method is described using an application to a server as an example. Figure 1 As shown, the method includes: Step 100: Conduct LoRA incremental pre-training and LoRA instruction fine-tuning based on the base large model to obtain the final version of the large model; for example, the base large model can be Qwen3-32B.

[0021] Step 101: Obtain user input and determine the type of user input; Step 102: Determine the dialogue template based on the type of user input, and use the final version of the large model for reasoning to generate a network security compliance report text.

[0022] In another exemplary embodiment of this application, the task of generating information security compliance report text has significant complexity and diversity. Using traditional full-parameter training methods not only consumes substantial computational resources (such as computing power and storage) but also leads to low model iteration efficiency due to excessively long training cycles. To address this issue, this application performs LoRA incremental pre-training in step 100 above. This approach eliminates the need to update all parameters of the base model; model adaptation can be achieved by training only a small number of low-rank matrix parameters. This significantly reduces computational resource consumption, accelerates the training process, and achieves model performance similar to full-parameter training. However, while LoRA incremental pre-training can rapidly enhance the vertical capabilities of the large model in the field of information security compliance report generation, it carries the risk of domain overfitting. That is, after the large model is over-adapted to the information security compliance scenario, its capabilities in general text understanding, logical reasoning, etc., may degrade. To resolve this contradiction, the large model can be fine-tuned using LoRA instructions based on heterogeneous dialogue templates. Therefore, in the specific implementation of step 100 above, this application can introduce a heterogeneous dialogue template different from the native template of the base large model, and then perform LoRA instruction fine-tuning. This strengthens the large model's grasp of knowledge in the information security domain while avoiding the loss of general capabilities. Based on this, the implementation process of step 100 above in this application may include: Step 1: Construct an incremental pre-training dataset and perform LoRA incremental pre-training on the base model until the first set condition is met (e.g., the validation set loss does not decrease for 3 consecutive steps), thus obtaining the cybersecurity knowledge model. In practical applications, the incremental pre-training dataset used in this step can be an open-source dataset from Huggingface (link: https: / / huggingface.co / datasets / clouditera / security-paper-datasets). This incremental pre-training dataset contains the following content in the field of cybersecurity: (1) theoretical knowledge: laws and regulations, academic papers, industry reports, etc.; (2) practical knowledge: vulnerability details, CTF question bank, log traffic, malicious samples, etc.; (3) application knowledge: security community blogs, training materials, security knowledge graphs, etc. Furthermore, in order to enable the base model to focus on mastering the theoretical knowledge in the field of cybersecurity, and thus lay a solid foundation for the subsequent cybersecurity level protection report generation task, theoretical knowledge, practical knowledge and application knowledge can be screened and integrated in a ratio of 5:2:3.

[0023] The principle of LoRA is as follows: Figure 2 As shown, Figure 2 The left part (i.e. the blue part) is the weight parameters of the pre-trained large model, with both input and output dimensions of d, which are frozen during fine-tuning training; Figure 2 The right-hand side (orange part) represents the trainable weight parameters added by LoRA, consisting of two low-rank decomposition matrices, A and B, with rank r. Low-rank decomposition matrix A is initialized using a random Gaussian distribution and has a dimension of r×k, responsible for reducing the input data dimension to r dimensions; low-rank decomposition matrix B is initialized with 0 and has a dimension of d×r, responsible for increasing the data dimension to r. Dimension. Based on this, let's assume... Figure 2 The pre-trained weight parameter matrix is W=BA, where , Then the output data h after fine-tuning the large model of the base is the sum of the two parts of the output data, and we have: (1) If the base model is trained with all parameters, it is necessary to relearn each model parameter in the base model, which poses great difficulties in the storage and deployment of the large model. The objective function for its optimization is shown in the following formula (2). (2) In the formula, Φ represents the optimization parameters of the large-scale base model. For multi-task learners, These are the input (i.e., the context sequence) and output (i.e., the next token) of the base model, respectively. For the output sequence y At any moment t The label to be predicted, For the training dataset used for incremental pre-training, This is the index of the current time step or position in the output sequence.

[0024] Furthermore, this application uses only a very small number of parameters. After fine-tuning and optimizing the large base model, the large base model can also achieve good results. Based on this, the objective function after fine-tuning is shown in the following formula (3): (3) In the formula, This is the main part of the base model that is optimized, thereby generating a fine-tuned model (i.e., the cybersecurity knowledge model). Generate the first [model] under given context conditions. t The conditional probability of a label. These are the initial pre-trained weights for the base model. For the weight increments during the fine-tuning process, These are the fine-tuned model parameters ultimately used for inference.

[0025] Furthermore, in practical applications, the LoRA incremental pre-training hyperparameters in step 1 can be configured as follows: LoRA rank is 32, learning rate is 5e-5, batch size is 8, and optimizer is adamw_torch.

[0026] Step 2: Obtain the historical cybersecurity compliance report and related standard content, and convert them into a structured format to obtain structured data; Among these, the cybersecurity compliance reports are mostly in semi-structured document format, while the datasets for fine-tuning large models need to meet the {input, output} format. Therefore, the primary task is to convert the compliance reports into the model training data format. Furthermore, due to differences in the recording habits and expression styles of assessment personnel, existing reports suffer from non-standard text recording, necessitating the screening and cleaning of the original data. Manual screening would not only require a huge workload but also struggle to guarantee efficiency and consistency. Therefore, the semantic understanding and judgment capabilities of large models can be leveraged to automate data screening, laying a high-quality data foundation for subsequent model training. Moreover, since historical cybersecurity compliance reports and related standards (i.e., standard content) are mostly in Word format, the implementation process of step 2 above can be: First, an automated program is used to extract the target content from these Word documents. The target content extracted from the cybersecurity compliance report includes the assessment record section and the assessment summary section. Content extracted from relevant standards includes the compliance completion guidelines and compliance standard requirements.

[0027] Secondly, the extracted target content is stored in a CSV file. Each column of the CSV file corresponds to a specific target content item, and each row corresponds to a sample of a compliance report item. This process yields structured results (i.e., structured data).

[0028] Step 3: Using a large-scale cybersecurity knowledge model, score the structured data on writing standardization and filter out samples with scores less than or equal to a set threshold (e.g., 3 points) to obtain the remaining samples; For example, the information input to the cybersecurity knowledge model is assessment records and corresponding compliance guidelines. This is then concatenated with the following instruction: "Please evaluate whether the following assessment records comply with the guidelines, with a score range of 1 to 5 (1 indicating no compliance and 5 indicating full compliance). Please output a number between 1 and 5." Next, an automated script allows the cybersecurity knowledge model to score each sample in the dataset based on the prompts. Finally, assessment records with scores of 3 or higher are retained as the final data source (i.e., the remaining samples).

[0029] Step 4: Generate an instruction fine-tuning dataset based on the remaining samples, and embed the inputs and outputs in the instruction fine-tuning dataset into a heterogeneous dialogue template that is different from the native dialogue template of the base model to generate a dialogue dataset; The instruction fine-tuning dataset can consist of three parts: instruction, input, and output. The instruction specifies the type of text to be generated, i.e., evaluation record or evaluation summary; the input provides the information needed to generate the text, including device name, standard requirements, security issues, etc., which are derived from real evaluation reports and relevant cybersecurity compliance standards; the output is the evaluation record or evaluation summary text extracted from real evaluation reports.

[0030] Dialogue templates refer to the fixed format used by large models during training or inference to organize instructions, inputs, and expected outputs, helping them accurately understand the context and generate expected responses. Different large models have different dialogue templates; for example, the dialogue templates for the Qwen3 series models are as follows: <|im_start|>user\n{{content}}<|im_end|>\n<|im_start|>assistant\n{{response}.

[0031] Here, {{content}} represents both the instructions and the input. {{response}} is the training corpus expected to be output during the training phase; it is empty during the inference phase, meaning that the content to be generated by the model is required.

[0032] When the base model uses Qwen3-32B, a new heterogeneous dialogue template can be selected, including: ### Instruction:\n{{content}}\n\n### Response:\n{{response}}.

[0033] In this dataset, the instruction and input from the instruction fine-tuning dataset are concatenated together as {{content}} and then populated into the heterogeneous dialogue template. The output is used as {{response}} and also populated into the heterogeneous dialogue template. In short, dialogue template + {{content}} + {{response}} = the final instruction fine-tuning dataset (i.e., the dialogue dataset).

[0034] Step 5: Divide the dialogue dataset into training, validation, and test sets; for example, divide it into training, validation, and test sets in a 7:1:2 ratio.

[0035] Step 6: After fine-tuning the large-scale cybersecurity knowledge model using LoRA instructions with the training and validation sets, the fine-tuned model is evaluated using the test set to obtain the evaluation results. The validation set is used to determine when to stop fine-tuning; fine-tuning stops when the validation loss value decreases to a certain level and no longer significantly decreases. The input to the instruction fine-tuning dataset is {{content}} from Step 4, and the output is {{response}}.

[0036] Furthermore, in practical applications, the hyperparameters are configured as follows during LoRA instruction fine-tuning: LoRA rank is 32, learning rate range is 5e-5 to 5e-6, batch size range is 8 to 32, and the optimizer is adamw_torch.

[0037] In the field of text generation, while automated metrics such as Bleu and Rouge can provide a preliminary assessment of the generation effect at the level of word overlap, they alone cannot comprehensively measure the professionalism, accuracy, and compliance of the text. To address this issue, this application constructs a multi-dimensional evaluation system combining "automated metrics + large model scoring + security compliance assessment expert scoring" to ensure comprehensive and reliable evaluation results. Based on this, in this embodiment, the process of obtaining the evaluation results can be as follows: Two important evaluation metrics in the field of natural language processing, Bleu-4 and Rouge-1, were selected as evaluation standards. The Bleu-4 metric calculates the performance of the model based on word, phrase, and n-gram (n is at most 4) matching between the generated sentence and the human-referenced sentence. The Bleu-4 value is calculated as shown in formula (4), where N=4. Indicates the degree of matching. is the weight of each n-gram, with the weights being the same by default. BP is a penalty factor, and its calculation method is shown in formula (5). Indicates the length of the model result. This indicates the length of the standard answer. The Bleu-4 index typically ranges from 0 to 1, where 1 represents a perfect match. Rouge-1 primarily focuses on whether the machine-generated summary captures information from the reference summary, emphasizing the completeness of the content and information covered in the reference summary. The Rouge-1 calculation formula is shown in formula (6). This refers to multiple reference abstracts. This indicates the number of 1-grams that appear in both the abstract to be evaluated and the reference abstract. This represents the total number of 1-grams in the reference abstract. The Rouge-1 score also ranges from 0 to 1, with values ​​closer to 1 indicating higher quality.

[0038] Based on the text output by the model and the real text, the Bleu-4 and Rouge-1 values ​​can be calculated. Then, multiplying them by 100 and taking the average gives the model's score on the Bleu / Rouge metric.

[0039] (4) (5) (6) In the formula, For Bleu-4 value, The value is Rouge-1. For n-grammatical phrases, This is a reference text sequence.

[0040] The large model scoring is an automatic scoring process for the cybersecurity knowledge large model obtained in step 1. The instruction given to the model is: "Please evaluate the similarity between the following two texts, with a score range of 1 to 5." Then, by adding the real text and the text output by the model, the performance of the large model before and after fine-tuning on the test set can be automatically scored. Finally, these scores are averaged to obtain the final large model score.

[0041] The expert scoring for the cybersecurity compliance assessment involves experts rating the text generated by the large model before and after fine-tuning. Due to limited time and energy of the experts, 100 samples are randomly selected from the test set, and the experts rate the quality of the model output on the aspects of completeness, correctness, and standardization, ranging from 1 to 10. Finally, the average of the sample scores is taken to obtain the expert score.

[0042] After obtaining the three evaluation metrics (Bleu-4 and Rouge-1, the large model score, and the cybersecurity compliance assessment expert score), each metric was first calculated as a score / full score, and then a weighted average was taken. Considering the small sample size of the cybersecurity compliance assessment expert scores, their weight in the final result calculation was also relatively small. Therefore, a weighted average of the three metrics in a 4:4:2 ratio was used to obtain the final score of the model output quality (i.e., the evaluation result).

[0043] Step 7: Optimize the hyperparameters of the cybersecurity knowledge model based on the evaluation results until the optimized model's metrics meet the second predefined condition, thus obtaining the final version of the model. Hyperparameter optimization includes both training and inference phases. During training, adjusted hyperparameters include LoRA rank, learning rate, and batch size. During inference, the adjusted hyperparameter is the temperature value.

[0044] In another exemplary embodiment of this application, the implementation process of determining the dialogue template based on the type of user input in step 102 above can be as follows: (1) When the type of user input is a general task (such as daily dialogue, general text generation, etc.), the dialogue template adopts the native dialogue template of the base model. At this time, the user input is embedded into the native dialogue template of the base model for inference; (2) When the type of user input is a network security level protection report content generation task, the dialogue template adopts a heterogeneous dialogue template. At this time, the user input is embedded into the new dialogue template adopted above for inference. Among them, the judgment process of determining the dialogue template is triggered based on whether the user input conforms to the specific task format. Based on the above description, the dataset of the network security level protection report content generation task follows a fixed structure organization method, that is, it contains three fields: instruction, input, and output. Before the user requests to enter the final version of the large model, the input format will be verified by an automated program: If the input format meets the above three-part structure, it is determined that the user's intention is to perform the "Network Security Level Protection Report Content Generation Task" and the corresponding new dialogue template is automatically used; if the input format does not meet the three-part structure, it is identified as a "General Task" and the default native dialogue template is used for processing.

[0045] The following is a specific example illustrating how to generate a cybersecurity compliance report using the method provided in this application.

[0046] Suppose the task is to generate the assessment summary in the information security compliance report, and input the following: Instruction: Please generate an assessment summary based on the following content.

[0047] Input: Device Name: xxx; Security Issue: xxxxx; Standard Requirements: xxxxx.

[0048] Output: Evaluation Summary.

[0049] Because the input conforms to a three-part structure, the program determines that it is performing a task to generate a network security level protection report and embeds it into a new dialogue template. The embedded input becomes: ### Instruction:\n{{Please generate an assessment summary based on the following content. Device name: xxx; Security issue: xxxxx; Standard requirement: xxxxx}}\n\n### Response:\n{{Assessment summary:}}. Inputting the above content into the final large model will output the assessment summary.

[0050] Based on the above description, in practical applications, the method for generating network security compliance reports provided in this application mainly includes the following five steps: The first step is to perform incremental pre-training on the base model in the cybersecurity domain. That is, to build an incremental pre-training dataset and perform LoRA incremental pre-training on the base model to obtain a large model in the cybersecurity knowledge domain.

[0051] The second step involves extracting structured text from cybersecurity level protection reports and standards, constructing a dedicated dataset for generating cybersecurity level protection report text, and then using the cybersecurity knowledge model obtained in the first step to automatically filter the dataset. Specifically, this involves collecting cybersecurity level protection reports and related standards, converting their content into a structured format, and then using the cybersecurity knowledge model obtained in the first step to filter the structured text.

[0052] The third step involves employing a heterogeneous dialogue template + LoRA (Low-Rank Adaptation) fine-tuning method to inject vertical capabilities while preserving the model's general capabilities. Specifically, the remaining filtered samples are organized into a fine-tuning dataset, which is then constructed using heterogeneous dialogue templates. The processed dataset is then divided into training, validation, and test sets, and LoRA fine-tuning is performed on a large-scale model in the cybersecurity knowledge domain.

[0053] The fourth step involves combining manual and automated evaluation metrics to validate the model's performance and continuously fine-tuning hyperparameters. Specifically, a test set is used to evaluate the finely tuned large model. Hyperparameters are then fine-tuned based on the evaluation results, and this process is repeated until the fine-tuned large model's metrics show no significant improvement, resulting in the final version of the large model.

[0054] Fifth, during the inference phase, if the large model needs to perform a general task, the user input is embedded into the native dialogue template of the base large model; if it needs to perform a task to generate cybersecurity level protection report content, the user input is embedded into the heterogeneous dialogue template used in the instruction fine-tuning phase. That is, when performing a general task, the native dialogue template of the base large model is used; when performing a task to generate cybersecurity level protection report content, a new dialogue template is used.

[0055] In summary, the overall implementation architecture of the network security compliance report text generation method provided in this application is as follows: Figure 3 As shown, the process is divided into three main parts. The first part is model fine-tuning, which mainly involves incremental pre-training, instruction fine-tuning, and hyperparameter optimization of the base model. The second part is instruction fine-tuning, which mainly involves extracting structured text from the compliance report and standards, filtering the text, and then constructing an instruction fine-tuning dataset using heterogeneous dialogue templates. The third part is task generation validation, which mainly involves evaluating the output of the fine-tuned large model and selecting appropriate dialogue templates to guide the output of the large model based on the task. Figure 3 The parts that are not clearly shown are only for style examples and are not intended to be specific limitations of this application.

[0056] Compared with the prior art, this application has at least the following advantages: (1) This application uses an open-source cybersecurity knowledge dataset and a self-built cybersecurity compliance dataset to perform incremental pre-training and instruction fine-tuning on the base model, resulting in the first large model that is adapted to the task of generating cybersecurity compliance report text.

[0057] (2) Compared with the traditional LoRA fine-tuning method, this application uses a heterogeneous template that is different from the native dialogue template of the base model for LoRA fine-tuning, thereby retaining more of the general capabilities of the base model while increasing its capabilities in vertical domain tasks.

[0058] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 4As shown, the computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data for generating network security compliance report texts. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for generating network security compliance report texts.

[0059] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0060] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0061] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0062] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0063] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0064] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (RRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0065] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0066] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for generating network security compliance report text, characterized in that, The method comprises the following steps: Based on the base large model, LoRA incremental pre-training and LoRA instruction fine-tuning are carried out to obtain the final version of the large model. Obtain user input and determine the type of the user input; Based on the type of the user input, determine the dialogue template, and use the final version of the large model to generate network security protection report text. 2.The network security protection report text generation method according to claim 1, characterized in that, Based on the base large model, LoRA incremental pre-training and LoRA instruction fine-tuning are carried out to obtain the final version of the large model, comprising: Construct an incremental pre-training data set, and carry out LoRA incremental pre-training on the base large model until the first set condition is reached to obtain a network security knowledge large model; Obtain network security historical protection reports and standard content related to the network security historical protection reports, and convert them into a structured form to obtain structured data; Use the network security knowledge large model to score the writing standardization of the structured data, and filter out samples with a score less than or equal to a set threshold to obtain remaining samples; Based on the remaining samples, generate an instruction fine-tuning data set, and embed the input and output in the instruction fine-tuning data set into a heterogeneous dialogue template different from the original dialogue template of the base large model to generate a dialogue data set; Divide the dialogue data set into a training set, a validation set, and a test set; After LoRA instruction fine-tuning of the network security knowledge large model using the training set and the validation set, the network security knowledge large model is evaluated using the test set to obtain an evaluation result; According to the evaluation result, the hyperparameters of the network security knowledge large model are optimized until the indicators of the optimized network security knowledge large model meet the second set condition to obtain the final version of the large model. 3.The network security protection report text generation method according to claim 2, characterized in that, During the LoRA incremental pre-training process of the base large model, the optimization objective function used is: ； wherein Φ is an optimization parameter of the base large model, is a multi-task learner, is an input and an output of the base large model, respectively, is an output sequence y at time t is a label to be predicted, is a training dataset for incremental pre-training, is a current time step or position index in the output sequence. 4.The network security protection report text generation method according to claim 2, characterized in that, Obtain network security historical protection reports and standard content related to the network security historical protection reports, and convert them into a structured form to obtain structured data, comprising: Use an automated program to extract target content from network security historical protection reports and standard content related to the network security historical protection reports; Store the extracted target content in a csv file to obtain the structured data. 5.The network security protection report text generation method according to claim 2, wherein, The heterogeneous dialogue template refers to a template that organizes instructions, inputs, and expected outputs in a fixed format. 6.The network security protection report text generation method according to claim 1, wherein, During the LoRA incremental pre-training and LoRA instruction fine-tuning process, the LoRA rank is 32, the learning rate range is 5e-5 to 5e-6, the batch range is 8 to 32, and the optimizer uses adamw_torch. 7.The network security protection report text generation method according to claim 2, wherein, Based on the type of the user input, determine the dialogue template, comprising: When the type of the user input is a general task, the dialogue template uses the original dialogue template of the base large model; When the type of the user input is a network security protection report content generation task, the dialogue template uses the heterogeneous dialogue template.

8. A computer device comprising: The memory, the processor and the computer program stored in the memory and capable of running on the processor, characterized in that the processor executes the computer program to implement the network security network security protection report text generation method in any one of claims 1-7.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the network security network security protection report text generation method in any one of claims 1-7.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the network security network security protection report text generation method in any one of claims 1-7.

Images