Network security situation awareness method and system based on large model and threat assessment

Abstract

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system based on a large model and threat assessment. The method comprises the following steps: firstly, acquiring and standardizing multi-modal security data in a cloud service environment in real time, distributing a behavior modal cluster for security event metadata through clustering analysis, and generating a security feature vector containing business semantics and behavior dynamic features based on a cluster center relocation technology; then constructing a local situation map reflecting asset topology and an access link by using a cloud security association model; semantic reasoning is performed on the atlas through a large language model, an attack intention is recognized, and an attack path is predicted; and finally, combining the path probability, the asset value and the vulnerability feature to quantitatively calculate a risk index, and automatically generating a response strategy. Semantic compression of massive logs is realized through modal clustering, and the calculation bottleneck of processing original data by a large model is overcome; and in combination with graph correlation and large model reasoning, the crossing from passive warning to active intention prediction is realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security situation awareness method and system based on large models and threat assessment. Background Technology

[0002] With the widespread adoption of cloud computing and cloud-native technologies, enterprise businesses are heavily reliant on virtualization architectures, microservices, and containerized resources. In this highly dynamic and complex cloud service environment, real-time acquisition of multi-source, heterogeneous security data and situational awareness have become core means of ensuring network security. Currently, the industry primarily detects abnormal behavior by collecting system call logs, VPC flow logs, and identity access records, and utilizing pre-defined expert rules or statistical models. This approach is effective in handling known threats and static environments and is the mainstream technical path in the current field of network security situational awareness.

[0003] However, traditional situational awareness solutions exhibit significant limitations when facing increasingly complex cloud security challenges. On one hand, the massive amounts of raw logs lead to severe alarm redundancy, and due to the lack of deep semantic correlation with business operations, traditional feature matching methods struggle to extract the attacker's true intent from fragmented data. This results in advanced inference tools such as large models failing to leverage their semantic advantages due to excessive input noise. On the other hand, cloud resources are characterized by instantaneous start-up and shutdown and frequent migration. Existing static behavioral benchmarks cannot adapt to the normal evolution of business operations, are highly susceptible to false alarms due to business fluctuations, and struggle to accurately deduce and quantitatively assess the risks of covert attack paths across hosts and over long periods. This leads to delayed security response decisions and fails to meet the real-time and precise defense requirements of cloud service environments. Summary of the Invention

[0004] To overcome the above shortcomings, this invention provides a network security situation awareness method and system based on large models and threat assessment. It aims to achieve semantic compression and spatial correlation of massive data through dynamic relocation of cluster centers and graph modeling, and to realize the identification of attack intent behind abnormal behavior and automated risk closed-loop handling by utilizing the logical reasoning capabilities of large language models.

[0005] In a first aspect, the present invention provides the following technical solution: a network security situation awareness method based on large models and threat assessment, comprising: S1. Acquire multimodal security data in the cloud service environment in real time, and clean and standardize the multimodal security data to obtain security event metadata; S2. Associate business attribute tags with the security event metadata, assign behavioral modality clusters to the security event metadata based on clustering analysis, and perform vector mapping on different behavioral modality clusters through vector encoding to generate security feature vectors under different behavioral modalities; S3. Import the security feature vector into a preset cloud security association model, and use the behavioral modality cluster and its associated business attribute tags to construct a local situation map reflecting the asset topology and access links; S4. Input the structured description of the local situation map into the pre-trained large language model, use the semantic reasoning ability of the large language model to identify the attack intent behind the abnormal behavior, and generate a predicted attack path. S5. Combining the predicted attack path, target asset value, and environmental vulnerability characteristics, perform multi-dimensional threat scoring and quantitatively calculate the risk indicators of the current cloud service environment's threat level. S6. Visualize the security posture based on the risk indicators and call the large language model to analyze the current threat scenario in order to automatically generate targeted response strategies.

[0006] Preferably, in step S2, the multimodal security data includes system call logs, Virtual Private Cloud (VPC) flow logs, and identity access logs; the step of obtaining security event metadata includes: The collected raw multimodal security data is deduplicated and format aligned to achieve standardization of heterogeneous data; Extract common key fields from the standardized data and reconstruct the original records from different dimensions into security event metadata with a unified semantic structure.

[0007] Preferably, in step S1, the step of assigning behavioral modality clusters to the security event metadata based on cluster analysis includes: Obtain a preset safety behavior benchmark library, which contains standard feature center vectors under different behavior modalities; The real-time acquired security event metadata is mapped to a multi-dimensional feature space, and the distance between each data point and each standard feature center vector is calculated. Based on the distance calculation results, the data points are assigned to the corresponding behavioral modality clusters.

[0008] Preferably, in step S2, the step of generating security feature vectors under different behavioral modalities includes: Relocate the center of the behavioral modality cluster and obtain the corresponding center feature parameters; Obtain the one-hot encoding of the business attribute tag corresponding to the behavioral modality cluster; The central feature parameters are concatenated with the one-hot encoding to construct a composite feature representation. The composite feature representation is processed by a preset vector mapping model to generate a fixed-dimensional security feature vector.

[0009] Preferably, in step S3, the step of constructing a local situation map reflecting the asset topology and access links includes: Using the asset entities corresponding to the business attribute tags as graph nodes and the behavioral modal clusters corresponding to the security feature vectors as directed edges, an asset behavior association graph is initially constructed. Retrieve the network topology information and logical attribution relationship of the asset entity in the cloud environment, and overlay it as a constraint on the asset behavior association graph to generate an initial situational map with topology awareness; The node features and edge features in the initial situation map are aggregated to generate the local situation map describing the interaction state between the asset entities and the potential threat propagation path.

[0010] Preferably, in step S4, the step of generating the predicted attack path includes: The large language model is used to identify the abnormal behavior chain that has occurred in the local situation map, and the attack stage of the abnormal behavior chain is characterized based on the preset attack tactic library. Based on the asset vulnerability and edge connectivity of nodes in the local situation map, the large language model is used to logically deduce the possibility of the current abnormal behavior chain spreading in the spatial dimension. Based on the simulation results, a probability sequence containing potential attack targets and expected attack timings is generated to form the predicted attack path.

[0011] Preferably, in step S5, the step of quantitatively calculating the risk indicators of the current cloud service environment's threat level includes: The attack path prediction probability output by the large language model is obtained as a probability factor reflecting the likelihood of a threat occurring. Based on the asset tags and preset business importance in the local situation map, the value loss factor of the threatened assets is determined; By combining the vulnerability severity score in the aforementioned environmental vulnerability characteristics, the impact scope factor of the threat event is determined; The risk index is generated by integrating the probability factor, the value loss factor, and the scope of influence factor using a preset risk assessment function.

[0012] Preferably, in step S6, the step of automatically generating a targeted response strategy includes: The large language model is used to analyze the threat scenarios corresponding to the risk indicators, and candidate protection actions that match the current cloud environment architecture are retrieved from the preset security knowledge base. By combining the business logic relationships in the local situation map, the large language model is used to evaluate the potential impact of each candidate protection action on normal business continuity, and the target response strategy that meets the preset security gain and minimizes business interference is selected.

[0013] Secondly, the present invention provides the following technical solution: a network security situation awareness system based on large models and threat assessment, used to implement any of the above-mentioned network security situation awareness methods, including: The data acquisition and processing module is used to acquire multimodal security data in the cloud service environment in real time, and to clean and standardize the multimodal security data to obtain security event metadata. The data aggregation and encoding module is used to associate business attribute tags with the security event metadata, assign behavioral modality clusters to the security event metadata based on cluster analysis, and perform vector mapping on different behavioral modality clusters through vector encoding to generate security feature vectors under different behavioral modalities. The local situation construction module is used to import the security feature vector into a preset cloud security association model, and use the behavioral modality cluster and its associated business attribute tags to construct a local situation map that reflects the asset topology and access links. The attack intent reasoning module is used to input the structured description of the local situation map into a pre-trained large language model, use the semantic reasoning ability of the large language model to identify the attack intent behind the abnormal behavior, and generate a predicted attack path. The threat quantification assessment module is used to combine the predicted attack path, target asset value and environmental vulnerability characteristics to perform multi-dimensional threat scoring and quantitatively calculate the risk indicators of the current cloud service environment's threat level. The situation visualization module is used to visualize the security situation based on the risk indicators and call the large language model to analyze the current threat scenario in order to automatically generate targeted response strategies.

[0014] The present invention has the following beneficial effects: 1. This invention utilizes a clustering mechanism guided by a security behavior benchmark library to map massive discrete multimodal logs into behavioral modality clusters with semantic features, achieving high-ratio compression from raw data to high-dimensional vectors. This semantic compression technique effectively avoids the computational bottleneck when large models directly process massive logs, significantly reducing redundant interference while preserving core security features, and providing a highly signal-to-noise ratio inference foundation for large models.

[0015] 2. This invention utilizes cluster center relocation technology to dynamically adjust the center of gravity of behavioral modalities based on real-time traffic. Compared to traditional static detection models, this mechanism allows the system to automatically identify and adapt to the normal evolution and seasonal fluctuations of cloud services, resolving false alarms caused by changes in business logic or resource migration. This ensures that the situational awareness vector can always accurately reflect minute deviations relative to the current business baseline, greatly improving the sensitivity to anomaly behavior identification. Attached Figure Description

[0016] Figure 1 This is a flowchart of the network security situation awareness method based on large models and threat assessment proposed in this invention; Figure 2 This is a framework diagram of the network security situation awareness system based on large models and threat assessment proposed in this invention. Detailed Implementation

[0017] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1 In a first embodiment of the present invention, the present invention provides a network security situation awareness method based on large models and threat assessment, such as... Figure 1 As shown, it includes: S1. Acquire multimodal security data in the cloud service environment in real time, and clean and standardize the multimodal security data to obtain security event metadata; Preferably, in step S1, the multimodal security data includes system call logs, Virtual Private Cloud (VPC) flow logs, and identity access logs; the step of obtaining security event metadata includes: The collected raw multimodal security data is deduplicated and format aligned to achieve standardization of heterogeneous data; Extract common key fields from the standardized data and reconstruct the original records from different dimensions into security event metadata with a unified semantic structure.

[0019] Specifically, the system first establishes a multimodal data acquisition plane for the cloud service environment, in which multimodal security data covers system call logs at the kernel layer, virtual private cloud (VPC) flow logs at the network layer, and identity access management logs at the application layer.

[0020] The first stage of data processing is the standardization of heterogeneous data. The acquisition module performs global deduplication on the raw streaming data acquired in real time, eliminating redundant records generated by distributed sampling or retransmission mechanisms. Subsequently, format alignment is performed, using a pre-defined parsing plugin to map raw logs in different formats such as JSON, Syslog, or binary streams to a unified intermediate representation layer, eliminating ambiguity in field naming. For example, source_ip and src_addr are standardized as source IP address fields, thereby achieving standardization of heterogeneous data at the syntax level.

[0021] The second stage of data processing is semantic reconstruction. The system extracts common key fields from the standardized intermediate-layer data. These fields include at least timestamps, subject identifiers, object identifiers, operational behaviors, and business environment characteristics. By establishing a unified semantic structure model, the originally isolated and multi-dimensional raw records are recombined across dimensions. For example, a single network connection record is spatiotemporally aligned with the corresponding host's system call behavior, encapsulating it into structured security event metadata. Each security event metadata record serves as an independent semantic unit, providing business-contextual input for subsequent clustering analysis and vectorization.

[0022] Through the above implementation methods, the present invention can effectively eliminate semantic silos between heterogeneous data in the cloud environment, and achieve deep fusion of cross-level data while preserving the original behavioral details, thus greatly improving the processing efficiency of massive amounts of raw logs.

[0023] S2. Associate business attribute tags with the security event metadata, assign behavioral modality clusters to the security event metadata based on clustering analysis, and perform vector mapping on different behavioral modality clusters through vector encoding to generate security feature vectors under different behavioral modalities; Preferably, in step S2, the step of assigning behavioral modality clusters to the security event metadata based on cluster analysis includes: Obtain a preset safety behavior benchmark library, which contains standard feature center vectors under different behavior modalities; The real-time acquired security event metadata is mapped to a multi-dimensional feature space, and the distance between each data point and each standard feature center vector is calculated. Based on the distance calculation results, the data points are assigned to the corresponding behavioral modality clusters.

[0024] Specifically, the system pre-loads and loads a security behavior benchmark library, which is a feature set built based on historical security experience and known threat models, and includes... The standard feature center vectors under different behavioral modalities are denoted as follows: Each standard feature center vector This represents the centroid of a typical network behavior pattern, such as legitimate database queries or high-frequency port scanning, in a multidimensional feature space.

[0025] The system extracts features from the real-time generated security event metadata and maps them to a multi-dimensional feature space consisting of time frequency, spatial distribution, behavioral intensity, and business semantic dimensions, forming data points to be classified. To achieve accurate mapping, the system calculates data points. Compared with the standard feature center vectors in the benchmark library Euclidean distance between The calculation formula is as follows: ; in, This represents the total number of dimensions in the feature space. and These represent the data point and the center vector at the th... Component values ​​in each dimension.

[0026] Finally, the system performs the allocation action according to the distance minimization principle. By comparing the distance between the data point and all standard feature center vectors, the system selects the behavioral modality corresponding to the nearest center vector as the category to which the data point belongs. Through the above allocation logic, the system merges the discrete original data points into the corresponding behavioral modality clusters in real time.

[0027] Through the above implementation methods, the present invention avoids the problem of slow convergence of traditional unsupervised clustering under massive data, and significantly improves the initial qualitative accuracy of complex security events by quickly aligning unknown behaviors to known modalities.

[0028] Preferably, in step S2, the step of generating security feature vectors under different behavioral modalities includes: Relocate the center of the behavioral modality cluster and obtain the corresponding center feature parameters; Obtain the one-hot encoding of the business attribute tag corresponding to the behavioral modality cluster; The central feature parameters are concatenated with the one-hot encoding to construct a composite feature representation. The composite feature representation is processed by a preset vector mapping model to generate a fixed-dimensional security feature vector.

[0029] Specifically, considering the dynamic evolution of cloud services, the system allocates the set of real-time data points to the cluster within the current sliding window. Recalculate the dynamic centroid of the cluster. Through the above relocation process, the system obtains central characteristic parameters that can reflect the current actual operating status of the business.

[0030] Secondly, the system synchronously processes the representation of the business semantic dimension. It acquires business attribute tags associated with the current behavioral modality cluster, such as asset sensitivity and security domain attributes, and transforms them into sparse vectors using one-hot encoding technology. The one-hot encoding transforms discrete tag semantics into numerical representations by setting the corresponding business dimension to 1 and the other dimensions to 0.

[0031] Subsequently, the system performs a feature stitching operation. The central feature parameters obtained from dynamic relocation are then... One-hot encoding with business attributes By performing linear concatenation, a composite feature representation is constructed. ,in, This represents a vector concatenation operation, and the composite feature representation simultaneously includes dynamic statistical information from the behavioral dimension and semantic qualitative information from the business dimension.

[0032] Finally, the system will characterize the composite features. The input is fed into a preset vector mapping model, which can optionally employ a multilayer perceptron or an autoencoder encoding end. Through nonlinear transformation, high-dimensional, sparse composite features are mapped to a continuous high-dimensional vector space, generating a fixed-dimensional security feature vector. .

[0033] Through the above implementation methods, the present invention realizes the transformation from discrete behavioral clusters to continuous semantic vectors. By using cluster center relocation technology, it solves the defect that traditional benchmark models cannot adapt to business drift and ensures that the generated security feature vectors effectively preserve real-time subtle changes in behavior.

[0034] S3. Import the security feature vector into a preset cloud security association model, and use the behavioral modality cluster and its associated business attribute tags to construct a local situation map reflecting the asset topology and access links; Preferably, in step S3, the step of constructing a local situation map reflecting the asset topology and access links includes: Using the asset entities corresponding to the business attribute tags as graph nodes and the behavioral modal clusters corresponding to the security feature vectors as directed edges, an asset behavior association graph is initially constructed. Retrieve the network topology information and logical attribution relationship of the asset entity in the cloud environment, and overlay it as a constraint on the asset behavior association graph to generate an initial situational map with topology awareness; The node features and edge features in the initial situation map are aggregated to generate the local situation map describing the interaction state between the asset entities and the potential threat propagation path.

[0035] Specifically, in the initial construction phase of the asset behavior association graph, the system extracts asset entity identifiers, such as the InstanceID or container ID of a virtual machine, from business attribute tags and defines them as nodes in the graph. Meanwhile, the behavioral modal clusters represented by the security feature vectors produced by S2 are defined as directed edges between nodes. The direction of the edges represents the flow of traffic or requests, thus constructing a preliminary association graph. It can intuitively present the logical interaction behaviors between various assets.

[0036] Secondly, the system incorporates topological constraints from the cloud environment to calibrate the association graph. The system retrieves real-time network topology information and logical affiliations of asset entities by calling the cloud platform API, and overlays these physical and logical constraints onto the initially constructed asset behavior association graph. If a directed edge between two nodes has an unreachable path or is blocked by security policies in the actual topology, the system will label or reduce its weight, thereby generating an initial situational awareness graph. This step eliminates false association interference, ensuring that the escort analysis focuses on real communication links.

[0037] Finally, the system performs feature aggregation processing on the initial situation map. Using a graph neural network, the asset value features of a node are spatiotemporally fused with the behavioral modality vectors of its associated edges. For any node... Its aggregated state characteristics This can be expressed as: ; in, Represents a node The set of neighboring nodes, Let be the feature vector of the edge pointing from neighboring nodes to this node. To learn the weight matrix, This is the activation function. Through this process, the system not only summarizes the interaction states of asset entities, but also implicitly injects potential threat propagation path information into the graph structure, ultimately generating a local situation map that describes the consistency between global and local security states.

[0038] Through the above implementation methods, this invention transforms the originally fragmented security feature vectors into a spatially correlated graph structure. This method fully considers the topological constraints in the cloud environment and avoids false alarms caused by network isolation in traditional correlation analysis.

[0039] S4. Input the structured description of the local situation map into the pre-trained large language model, use the semantic reasoning ability of the large language model to identify the attack intent behind the abnormal behavior, and generate a predicted attack path. Preferably, in step S4, the step of generating the predicted attack path includes: The large language model is used to identify the abnormal behavior chain that has occurred in the local situation map, and the attack stage of the abnormal behavior chain is characterized based on the preset attack tactic library. Based on the asset vulnerability and edge connectivity of nodes in the local situation map, the large language model is used to logically deduce the possibility of the current abnormal behavior chain spreading in the spatial dimension. Based on the simulation results, a probability sequence containing potential attack targets and expected attack timings is generated to form the predicted attack path.

[0040] Specifically, the system transforms the local situational awareness map into structured descriptive text that the large language model can understand, such as describing asset node attributes and edge association patterns using specific Prompt templates. In this embodiment, the large language model can be a language model based on the BERT or GPT framework, fine-tuned in conjunction with a cybersecurity knowledge base. After receiving the description, the large language model scans and identifies activated abnormal behavior chains in the graph, semantically aligning them with a preset MITREATT&CK or KillChain attack tactic library. By comparing behavioral characteristics with tactical patterns, the model qualitatively characterizes the identified abnormal behavior, clarifying that it is in a specific stage of the attack lifecycle. For example, identifying an abnormal behavior chain from an external web server to an internal database as conforming to the lateral movement stage characteristics of a credential theft attack.

[0041] The system inputs known vulnerability information such as the CVE ID and severity score of the target asset, as well as network reachability between nodes in the network graph, into the large language model. Based on these environmental constraints, the large language model simulates the attacker's decision-making process and logically deduces the probability of the current anomalous chain spreading across the cyberspace dimension.

[0042] Finally, based on the deduction results of the large language model, the system generates a probability sequence containing potential attack target nodes, expected attack methods, and the expected attack occurrence time. For example, the output sequence is: {Target: Core backup library; Probability: 0.85; Expected time: T+15min}. These probability sequences are arranged in a spatiotemporal dimension, constituting the predicted attack path.

[0043] Through the above implementation methods, the present invention combines real asset vulnerabilities with topological constraints, significantly reducing the false alarm rate of path prediction and enabling security managers to anticipate the attacker's next action intentions.

[0044] S5. Combining the predicted attack path, target asset value, and environmental vulnerability characteristics, perform multi-dimensional threat scoring and quantitatively calculate the risk indicators of the current cloud service environment's threat level. Preferably, in step S5, the step of quantitatively calculating the risk indicators of the current cloud service environment's threat level includes: The attack path prediction probability output by the large language model is obtained as a probability factor reflecting the likelihood of a threat occurring. Based on the asset tags and preset business importance in the local situation map, the value loss factor of the threatened assets is determined; By combining the vulnerability severity score in the aforementioned environmental vulnerability characteristics, the impact scope factor of the threat event is determined; The risk index is generated by integrating the probability factor, the value loss factor, and the scope of influence factor using a preset risk assessment function.

[0045] Specifically, the system extracts probability factors of a threat. These probability factors... This factor is directly derived from the attack path prediction probability output by the large language model in step S4. It reflects the probability of threat occurrence based on a comprehensive assessment of the maturity of the current attack chain, attacker activity, and topology reachability, embodying the proactive risk prevention attribute.

[0046] Secondly, the system analyzes the asset tags of target nodes in the local situation map and maps them using a pre-set business importance matrix to determine the value loss factor of threatened assets. The value loss factor is assigned a graded value based on the sensitivity of the business carried by the asset, ensuring that the risk weight of high-value targets is explicitly reflected in the calculation. For example, the core database is assigned a value of 1, the production gateway is assigned a value of 0.7, and the development environment is assigned a value of 0.5.

[0047] Subsequently, the system combines the vulnerability severity score from the environmental vulnerability characteristics with the connectivity of assets in the graph to further determine the impact scope factor of threat events. This factor not only characterizes the severity of a single vulnerability after it is exploited, but also measures the potential lateral spread of the threat within the cloud intranet caused by the node acting as a springboard. In one implementation, this factor is calculated as follows: ; in, This indicates the severity score of the CVSS vulnerability. This indicates the graph out-degree of the node.

[0048] Finally, the system utilizes a preset risk assessment function. The three factors mentioned above are combined and calculated to generate the final risk index. The evaluation function preferably uses a weighted product model, and the calculation formula is as follows: ; in, The weighting coefficients for the corresponding factors are dynamically adjusted based on preset security and compliance strategies. This generates risk indicators. They are mapped to different risk level ranges, serving as the basis for decisions that trigger subsequent automated responses.

[0049] Through the above implementation methods, the present invention realizes the transformation of risk assessment from static table lookup to dynamic inference. By introducing the predicted probability output by the large language model, the risk indicators can reflect the evolution trend of threats in real time, rather than just statically scanning historically known vulnerabilities.

[0050] S6. Visualize the security posture based on the risk indicators and call the large language model to analyze the current threat scenario in order to automatically generate targeted response strategies.

[0051] Preferably, in step S6, the step of automatically generating a targeted response strategy includes: The large language model is used to analyze the threat scenarios corresponding to the risk indicators, and candidate protection actions that match the current cloud environment architecture are retrieved from the preset security knowledge base. By combining the business logic relationships in the local situation map, the large language model is used to evaluate the potential impact of each candidate protection action on normal business continuity, and the target response strategy that meets the preset security gain and minimizes business interference is selected.

[0052] Specifically, the system intelligently retrieves protective actions. A large language model analyzes the threat types reflected by current risk indicators and matches corresponding candidate protective actions from a pre-set security knowledge base based on the current cloud environment's architectural characteristics. For example, for identified abnormal external connection behavior, candidate actions include blocking communication on specific ports, isolating infected containers, or updating authentication keys.

[0053] Secondly, a comprehensive assessment of the system's impact on business operations is conducted. The large language model invokes the local situation map from step S3, identifies the business dependencies between assets in the map, and predicts the degree of interference of each candidate protection action on normal business operations. The model follows the principle of maximizing security gains and minimizing business interference in its selection process. If a candidate action would disrupt core business links while blocking threats, its priority is reduced; if a candidate action, such as rate limiting for a specific IP, can suppress threat spread without affecting overall business continuity, it is designated as the target response strategy.

[0054] Finally, the large language model transforms the selected target response strategies into specific configuration parameters or execution scripts, which are then output to the cloud platform management interface for execution.

[0055] Through the above implementation methods, the present invention effectively solves the problem of mistakenly killing normal business when traditional security policies are issued by understanding business logic through a large language model.

[0056] Example 2 This invention also provides a network security situation awareness system based on large models and threat assessment, the structure of which is as follows: Figure 2 As shown, it includes: The data acquisition and processing module is used to acquire multimodal security data in the cloud service environment in real time, and to clean and standardize the multimodal security data to obtain security event metadata. The data aggregation and encoding module is used to associate business attribute tags with the security event metadata, assign behavioral modality clusters to the security event metadata based on cluster analysis, and perform vector mapping on different behavioral modality clusters through vector encoding to generate security feature vectors under different behavioral modalities. The local situation construction module is used to import the security feature vector into a preset cloud security association model, and use the behavioral modality cluster and its associated business attribute tags to construct a local situation map that reflects the asset topology and access links. The attack intent reasoning module is used to input the structured description of the local situation map into a pre-trained large language model, use the semantic reasoning ability of the large language model to identify the attack intent behind the abnormal behavior, and generate a predicted attack path. The threat quantification assessment module is used to combine the predicted attack path, target asset value and environmental vulnerability characteristics to perform multi-dimensional threat scoring and quantitatively calculate the risk indicators of the current cloud service environment's threat level. The situation visualization module is used to visualize the security situation based on the risk indicators and call the large language model to analyze the current threat scenario in order to automatically generate targeted response strategies.

[0057] To further disclose specific embodiments of the present invention, the following description is provided in conjunction with specific scenarios: In a production environment, an attacker gained access to the VPC through a vulnerability in a web container exposed to the public internet. To prevent the server from being attacked, the network security situation awareness system based on large-scale modeling and threat assessment provided by this invention was employed. The system's execution process is as follows: The data acquisition and processing module captures a large number of atypical system calls generated by the container and abnormal VPC flow logs pointing to the internal network database in real time. The system standardizes these logs into metadata containing the source container ID, target database IP, and operation instructions.

[0058] The data aggregation and encoding module found that the metadata was significantly different from the legitimate access patterns in the benchmark database, but matched the lateral probing patterns. Since the service was in a promotional period, the overall access frequency was higher. The system adjusted the normal benchmark through cluster center relocation, avoiding misjudgment of normal traffic, and ultimately generated a security feature vector containing high-value asset tags and probing patterns.

[0059] The local situational awareness module, through VPC topology analysis, discovered that although the container had access to the database, normal business logic should not involve cross-network segment scanning. The model constructed a local situational awareness map with the web container as the source and the core database as the target, marking edge features as highly suspected probes.

[0060] After analyzing the attack intent inference module and combining it with the ATT&CK tactical database, it was determined that this was in the reconnaissance and internal proliferation phase of a ransomware attack. Further LLM analysis revealed that if the database were compromised, the attackers might next reach the archive storage via the backup link, thus predicting an attack path from the web to the database and then to the backup storage.

[0061] The threat quantification assessment module obtained a path probability of 0.88 from the LLM, a database value factor of 1, and an impact scope factor of 0.73. Furthermore, the database contains an unpatched unauthorized access vulnerability. After fusion calculation, the risk indicators jumped directly to the critical level.

[0062] The situational awareness module analyzed the critical risk and retrieved the protection strategy. After a business impact assessment, LLM determined that shutting down the database port would affect online business, so it issued a more refined strategy: intercepting specific characteristic traffic from the web container at the WAF end and temporarily suspending the container's access credentials at the IAM end.

[0063] Through the above implementation methods, this invention can extract weak abnormal signals that are originally mixed in with massive amounts of daily logs. This not only accurately identifies the attacker's true intent but also eliminates false alarms during peak business periods through dynamic relocation technology. The final generated response strategy successfully cuts off the attack path while ensuring business continuity.

[0064] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A network security situation awareness method based on large models and threat assessment, characterized in that, include: S1. Acquire multimodal security data in the cloud service environment in real time, and clean and standardize the multimodal security data to obtain security event metadata; S2. Associate business attribute tags with the security event metadata, assign behavioral modality clusters to the security event metadata based on clustering analysis, and perform vector mapping on different behavioral modality clusters through vector encoding to generate security feature vectors under different behavioral modalities; S3. Import the security feature vector into a preset cloud security association model, and use the behavioral modality cluster and its associated business attribute tags to construct a local situation map reflecting the asset topology and access links; S4. Input the structured description of the local situation map into the pre-trained large language model, use the semantic reasoning ability of the large language model to identify the attack intent behind the abnormal behavior, and generate a predicted attack path. S5. Combining the predicted attack path, target asset value, and environmental vulnerability characteristics, perform multi-dimensional threat scoring and quantitatively calculate the risk indicators of the current cloud service environment's threat level. S6. Visualize the security posture based on the risk indicators and call the large language model to analyze the current threat scenario in order to automatically generate targeted response strategies.

2. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S1, the multimodal security data includes system call logs, Virtual Private Cloud (VPC) flow logs, and identity access logs; the steps for obtaining security event metadata include: The collected raw multimodal security data is deduplicated and format aligned to achieve standardization of heterogeneous data; Extract common key fields from the standardized data and reconstruct the original records from different dimensions into security event metadata with a unified semantic structure.

3. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S2, the step of assigning behavioral modality clusters to the security event metadata based on cluster analysis includes: Obtain a preset safety behavior benchmark library, which contains standard feature center vectors under different behavior modalities; The real-time acquired security event metadata is mapped to a multi-dimensional feature space, and the distance between each data point and each standard feature center vector is calculated. Based on the distance calculation results, the data points are assigned to the corresponding behavioral modality clusters.

4. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S2, the steps for generating security feature vectors under different behavioral modalities include: Relocate the center of the behavioral modality cluster and obtain the corresponding center feature parameters; Obtain the one-hot encoding of the business attribute tag corresponding to the behavioral modality cluster; The central feature parameters are concatenated with the one-hot encoding to construct a composite feature representation. The composite feature representation is processed by a preset vector mapping model to generate a fixed-dimensional security feature vector.

5. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S3, the steps of constructing a local situation map reflecting the asset topology and access links include: Using the asset entities corresponding to the business attribute tags as graph nodes and the behavioral modal clusters corresponding to the security feature vectors as directed edges, an asset behavior association graph is initially constructed. Retrieve the network topology information and logical attribution relationship of the asset entity in the cloud environment, and overlay it as a constraint on the asset behavior association graph to generate an initial situational map with topology awareness; The node features and edge features in the initial situation map are aggregated to generate the local situation map describing the interaction state between the asset entities and the potential threat propagation path.

6. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S4, the step of generating the predicted attack path includes: The large language model is used to identify the abnormal behavior chain that has occurred in the local situation map, and the attack stage of the abnormal behavior chain is characterized based on the preset attack tactic library. Based on the asset vulnerability and edge connectivity of nodes in the local situation map, the large language model is used to logically deduce the possibility of the current abnormal behavior chain spreading in the spatial dimension. Based on the simulation results, a probability sequence containing potential attack targets and expected attack timings is generated to form the predicted attack path.

7. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S5, the steps for quantitatively calculating the risk indicators of the current cloud service environment's threat level include: The attack path prediction probability output by the large language model is obtained as a probability factor reflecting the likelihood of a threat occurring. Based on the asset tags and preset business importance in the local situation map, the value loss factor of the threatened assets is determined; By combining the vulnerability severity score in the aforementioned environmental vulnerability characteristics, the impact scope factor of the threat event is determined; The risk index is generated by integrating the probability factor, the value loss factor, and the scope of influence factor using a preset risk assessment function.

8. The network security situation awareness method based on large model and threat assessment according to claim 1, characterized in that, In step S6, the steps for automatically generating a targeted response strategy include: The large language model is used to analyze the threat scenarios corresponding to the risk indicators, and candidate protection actions that match the current cloud environment architecture are retrieved from the preset security knowledge base. By combining the business logic relationships in the local situation map, the large language model is used to evaluate the potential impact of each candidate protection action on normal business continuity, and the target response strategy that meets the preset security gain and minimizes business interference is selected.

9. A network security situation awareness system based on large-scale models and threat assessment, characterized in that: The network security situation awareness method for implementing any one of claims 1-8 includes: The data acquisition and processing module is used to acquire multimodal security data in the cloud service environment in real time, and to clean and standardize the multimodal security data to obtain security event metadata. The data aggregation and encoding module is used to associate business attribute tags with the security event metadata, assign behavioral modality clusters to the security event metadata based on cluster analysis, and perform vector mapping on different behavioral modality clusters through vector encoding to generate security feature vectors under different behavioral modalities. The local situation construction module is used to import the security feature vector into a preset cloud security association model, and use the behavioral modality cluster and its associated business attribute tags to construct a local situation map that reflects the asset topology and access links. The attack intent reasoning module is used to input the structured description of the local situation map into a pre-trained large language model, use the semantic reasoning ability of the large language model to identify the attack intent behind the abnormal behavior, and generate a predicted attack path. The threat quantification assessment module is used to combine the predicted attack path, target asset value and environmental vulnerability characteristics to perform multi-dimensional threat scoring and quantitatively calculate the risk indicators of the current cloud service environment's threat level. The situation visualization module is used to visualize the security situation based on the risk indicators and call the large language model to analyze the current threat scenario in order to automatically generate targeted response strategies.

Images