Wireless network attack analysis method and system based on large model prompt project
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING UNIV OF SCI & TECH
- Filing Date
- 2026-01-15
- Publication Date
- 2026-04-28
Smart Images
Figure CN121940758A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and system for analyzing wireless network attacks based on large model hinting engineering. Background Technology
[0002] With the rapid development of wireless communication technologies (such as 5G, Wi-Fi 6, Bluetooth, etc.), wireless networks have become a core component of critical infrastructure. However, the openness and dynamism of these networks also provide malicious attackers with a huge attack surface, such as interference attacks, spoofing attacks, and replay attacks, posing a serious threat to the security and stable operation of the network.
[0003] To this end, cybersecurity researchers and engineers widely use high-fidelity network simulators (such as Exata, OPNET, NS-3, etc.) to reproduce complex network environments and attack scenarios in order to evaluate the robustness of network protocols and test new attack and defense mechanisms. More specifically, researchers configure attack scripts in simulators, which generate massive amounts of simulation data (such as packet logs, channel states, node movement trajectories, throughput, and latency). They then analyze this data to assess the impact of the attack and determine whether the attack strategy is effective.
[0004] However, existing attack analysis methods still have some shortcomings:
[0005] 1) Static rule-based analysis methods are ill-suited to dynamic and heterogeneous wireless network environments. Current mainstream analysis methods primarily rely on pre-written static detection scripts or predefined simple rules. However, modern wireless networks exhibit high dynamism and heterogeneity, with network topology, traffic, and node states constantly changing. Static rules struggle to automatically adjust and reason based on specific network contexts, topological characteristics, and service patterns. Manually adjusting rules or writing new scripts for each simulation is cumbersome, time-consuming, and difficult to scale. Therefore, an intelligent analysis method capable of understanding complex scenarios and performing dynamic logical reasoning is urgently needed.
[0006] 2) Large language models are general-purpose artificial intelligence models that are pre-trained on massive amounts of text, capable of understanding and generating natural language, and can generalize to various downstream tasks through instructions. Large language models have shown great potential in generalized reasoning, and are expected to replace manual analysis in complex tasks. However, large language models commonly suffer from the illusion problem, which means they may generate seemingly reasonable but erroneous, irrelevant, or fabricated content that does not match the actual input information (simulation data) or domain knowledge. If the original simulation data is directly input into the model and asked to analyze attacks, the results are often uncontrollable and unreliable, failing to meet the requirements of high-precision security analysis.
[0007] Therefore, the industry needs a more intelligent and efficient method for analyzing wireless network attacks using simulated data. Summary of the Invention
[0008] The purpose of this invention is to provide a wireless network attack analysis method and system based on large model prompting engineering, so as to realize automated attack analysis based on high-level semantic requirements, overcome the problems of complexity, time consumption and lack of diversity of traditional manual configuration of attack scripts, and ensure the depth, breadth and reproducibility of simulation testing.
[0009] The technical solution to achieve the purpose of this invention is as follows:
[0010] A wireless network attack analysis method based on large-scale model prompting engineering is proposed. For the large amount of multi-dimensional scenario data in simulated networks, a scenario description generator selectively transforms key data into ordered natural language descriptions, which are then added to the prompt template as scenario descriptions. The reasoning capabilities of the large language model are used to infer attack behaviors and extract attack parameters, thereby ensuring the automation and intelligence of the attack analysis. The entities involved in the analysis process are as follows: the attack analysis system (this system), the attack knowledge base, the prompt templates, the large language model, the EXata simulator, and the simulation database. The analysis is mainly divided into two stages: an offline stage and an online analysis stage. The specific steps of each stage are as follows:
[0011] Offline phase: Building an attack knowledge base and designing prompt templates;
[0012] Online Analysis Phase: The online analysis phase occurs after the simulator starts running, during which the system analyzes the simulation data. In this phase, the analysis system triggers automated analysis based on prompting engineering and large language models. Thus, this system can analyze feasible attacks and their parameters in the simulated network scenario. Specifically, this includes...
[0013] Collect simulation data;
[0014] The scenario description generator is used to generate ordered natural language descriptions of large language models that are easy to analyze from simulation data.
[0015] The generated ordered natural language description is used as a scene description and filled into the prompt template designed in the offline stage to form a complete prompt content;
[0016] The prompt is input into the large language model, which outputs the natural language analysis results of possible attack types (such as interference, deception, replay, etc.) in the current network scenario, and generates a natural language analysis report describing its reasoning process (for later manual analysis).
[0017] Extract the list of key attack parameters corresponding to the attack knowledge base from the analysis report, construct new prompts to guide the large language model to perform secondary reasoning, and output the structured key parameters (such as attack source, attack target, attack intensity, and attack frequency) corresponding to the attack type.
[0018] The structured key parameters are simulated in a simulator, and the simulated network state output is used as the result.
[0019] The attack knowledge base and prompt templates are updated based on simulation results.
[0020] Furthermore, the construction of the attack knowledge base includes: analysts extracting tactical descriptions of wireless network attacks (such as interference, spoofing, replay, etc.) from publicly available network datasets, defining the attack mechanism and key parameters of each attack, including attack preconditions, attack consequences, and key attack parameters.
[0021] Furthermore, the design prompt template includes:
[0022] Analysts have designed a prompt template to guide the analysis of large language models. The template consists of four parts:
[0023] Basic prompts: Clearly define the role and core objectives of the large language model in this analysis task;
[0024] Attack knowledge (embedded and utilized from the attack knowledge base): Using the content of the attack knowledge base, list the known attack types, the core mechanisms of each attack, and typical behavioral characteristic indicators related to this analysis task;
[0025] Scene description defines the structured format and content fields of the input simulation scene information.
[0026] Output constraints strictly define the output format and required fields of the large language model analysis results to ensure that the results can be automatically parsed by the subsequent system. Each attack must include the following fields: attack type, natural language analysis report, and all key parameters mapped from the attack knowledge section, and the return of irrelevant explanations or unstructured text is prohibited.
[0027] This system will store this template as a task instruction for inputting large language models during the online analysis phase.
[0028] Furthermore, the simulation data includes static and dynamic data from the simulation scenario, which is periodically collected from simulation software data or real-time data streams. Static data includes configuration files commonly used in the Exata simulation software (such as .config, .nodes, and .app files), which define the network topology, protocol stack configuration, and service traffic. Dynamic data includes runtime traffic, latency, packet loss rate, throughput, and node status information.
[0029] Furthermore, the simulation data is used to generate an ordered natural language description of the large language model that is easy to analyze, including: (1) Network topology and node status: extract basic information from static data to form a unified view at the node level, specifically including: node ID, node attributes: including the node's location coordinates, movement status, device type, and node connection topology; (2) Communication services: the flow ID, source node, destination node, service type, and traffic characteristics of each communication flow; (3) Network performance indicators: aggregate and analyze performance metrics in dynamic data to evaluate network conditions, specifically including: average latency, maximum / minimum latency of key service flows, packet loss rate of key service flows or links, packet arrival rate, instantaneous throughput of the network as a whole and key links, and average throughput.
[0030] Furthermore, the list of key attack parameters corresponding to the attack knowledge base is extracted from the analysis report, and new prompts are constructed to guide the large language model to perform secondary reasoning, outputting the structured key parameters corresponding to this attack type, specifically including:
[0031] First, extract the attack type from the analysis report, and then use this as an index to find the corresponding parameter in the parameter template of the attack knowledge base to obtain the parameter template.
[0032] After obtaining the parameter template, use this template as the core, combined with the original scene description and analysis report, to construct parameter extraction prompts, and submit them to the large language model again. These prompts will guide the large language model to output structured parameters according to the template requirements based on its previous analysis logic and original data.
[0033] Finally, the large language model generates the final structured attack results, which are then used for subsequent simulations.
[0034] Furthermore, the attack knowledge base and prompt templates are updated based on simulation results. Specifically, this includes: reviewing the simulated attack results in conjunction with the natural language analysis report from the large language model; if deviations exist, analyzing the reasons; and using the scenario data, prompts, large language model responses, and simulation results from this analysis process to update the offline attack knowledge base or optimize the prompt templates, making subsequent analysis results more accurate and better aligned with user intent.
[0035] Update the attack knowledge base: If the deviation stems from missing knowledge or inaccurate definitions, modify or expand the entries for the corresponding attack types in the knowledge base, supplement new attack characteristic indicators, revise the definitions or value ranges of key parameters, and add new attack variant templates;
[0036] Optimize prompt templates: If the deviation stems from ambiguity in the large model's understanding of the instructions or non-standard output, adjust the wording, structure, or output constraints of the prompt template.
[0037] A wireless network attack analysis system based on large model hinting engineering includes:
[0038] Attack knowledge base building unit, used to build attack knowledge base;
[0039] The prompt template design unit is used to design prompt templates;
[0040] The simulation data acquisition unit is used to acquire simulation data;
[0041] Scene description generation unit; uses the scene description generator to generate ordered natural language descriptions of large language models that are easy to analyze from simulation data;
[0042] The prompt content generation unit uses the generated ordered natural language description as a scene description and fills it into the prompt template designed in the offline stage to form complete prompt content.
[0043] The Natural Language Analysis Report Generation Unit takes the prompts and inputs them into the large language model. It outputs the natural language analysis results of the possible attack types in the current network scenario and generates a natural language analysis report describing the reasoning process.
[0044] The analysis unit extracts the list of key attack parameters corresponding to the attack knowledge base from the analysis report, constructs new prompts to guide the large language model to perform secondary reasoning, and outputs the structured key parameters corresponding to the attack type.
[0045] The simulation unit simulates the structured key parameters in the simulator and outputs the simulated network state as the result.
[0046] The update unit updates the attack knowledge base and prompt templates based on simulation results.
[0047] Compared with the prior art, the significant advantages of this invention are:
[0048] (1) High intelligence and automation: Based on the large language model method, the system can deeply understand the user's high-level natural language needs (such as "simulate a covert deception attack against a network hub node") and automatically reason and analyze. This replaces the traditional complex manual attack script writing and parameter configuration process that requires deep domain knowledge, greatly reduces the technical threshold for building simulation scenarios, and significantly shortens the time cycle from test intent to simulation execution.
[0049] (2) High reliability and anti-illusion properties: To address the inherent illusion problem of large language models, this invention integrates domain knowledge of wireless network attacks, analysis task constraints, and output format specifications into a carefully designed structured prompt template, effectively guiding and constraining the reasoning process of the large language model. This method can significantly suppress the generation of irrelevant or erroneous content, ensuring that the analysis results closely revolve around the input data and professional knowledge. Thus, while utilizing the powerful generalization ability of the large language model, it also guarantees the professional reliability and practical usability of the analysis results.
[0050] (3) High interpretability and iterativeness: Unlike traditional "black box" machine learning models, this invention utilizes the natural language processing and reasoning capabilities of a large language model. The analytical logic, judgment criteria (such as "why it is determined to be a deceptive attack"), and key parameters of the large language model can all be traced through the explanatory text it generates. In addition, by updating the knowledge base and templates during the online generation phase, the system can perform rapid iterative optimization based on simulation results and expected results, continuously improving the accuracy and authenticity of the generated configuration.
[0051] (4) Low overhead and high efficiency: Using natural language as input for high-level tasks greatly reduces the professional skill overhead of simulation analysts (no longer requiring proficiency in the scripting language or API of a specific simulator). Compared with the existing solutions where experts manually configure all parameters, the automated generation based on a large language model in this invention greatly reduces the manpower and time costs of simulation testing while ensuring attack analysis in complex wireless network attack scenarios. Attached Figure Description
[0052] Figure 1 This is a system model diagram of the present invention.
[0053] Figure 2 This is a basic flowchart of the analysis method for wireless network attacks based on large model hinting engineering of the present invention. Detailed Implementation
[0054] The present invention will now be described in further detail with reference to the accompanying drawings and examples. The following embodiments are implemented based on the technical solution of the present invention, providing detailed implementation methods and processes; however, the scope of protection of the present invention is not limited to the following embodiments.
[0055] This invention provides a method for analyzing wireless network attacks in a simulation environment based on large language model prompting engineering. The system model of this method is as follows: Figure 1 As shown, it includes three core entities: an attack analysis system, a large language model, and an EXata wireless network simulator.
[0056] The attack analysis system, as the core analysis hub, is responsible for scheduling tasks and coordinating components. Its main responsibilities include: collecting data from the simulator, converting raw data into structured natural language descriptions using a prompt generator, and parsing the output of the large language model. The large language model, as an intelligent entity possessing broad general knowledge and logical reasoning capabilities, interacts with the analysis system in this invention. It receives carefully designed prompts and reasons based on the attack knowledge embedded in the prompts, identifying potential attack behaviors in the simulation scenario and extracting their key parameters. The wireless network simulator is a virtual environment that generates simulation test data. It typically includes complex network topologies, protocol stacks, and channel models, capable of simulating various network scenarios, including attack behaviors, and outputting a large amount of dynamic and static data. In this invention, the simulator provides raw simulation data to the analysis system through a programmable interface (such as log files or APIs), simulates attacks according to the attack parameters generated by the large language model, and then generates simulation results for analyzing the attack compliance status.
[0057] This invention presents a wireless network attack analysis method based on large language model (GLAM) prompting engineering. Leveraging the contextual understanding and logical reasoning capabilities of GLAM, it intelligently analyzes the large amounts of multidimensional data generated from wireless network simulations, understanding users' natural language attack requirements and automating the reasoning and parameter extraction of attack behaviors. In each analysis task, the system automatically extracts key features from the simulation data, allowing GLAM to make inferences and judgments based on domain knowledge. This significantly reduces the technical threshold and time delay for security analysts moving from complex networks to attack insights. Furthermore, rigorous prompting engineering effectively guides and constrains the reasoning process of GLAM, significantly suppressing illusion phenomena and ensuring a high degree of consistency between the analysis results and the simulation data and domain knowledge, thereby greatly improving the credibility and reliability of automated analysis. Moreover, this invention is not only applicable to analyzing single attack events but also to identifying multi-stage, coordinated complex attack sequences.
[0058] This invention is mainly divided into two stages: an offline stage and an online generation stage. The basic flowchart is as follows: Figure 2 As shown. The offline phase represents the preparation phase before the simulation task is executed, such as... Figure 2 Steps 101 and 102 are shown in the middle; the online generation phase refers to the phase that occurs after the user initiates the simulation task, as shown in the middle. Figure 2 Steps 103 to 109 are shown in the middle section.
[0059] Step 101: Attack knowledge base construction.
[0060] Analysts or system administrators perform initial configuration for the attack analysis system. Specifically, as follows: (1) Analysts systematically extract characteristic information of wireless network attacks (such as interference, spoofing, replay, routing spoofing, and Sybil attacks) from network security knowledge or public datasets, and structurally define their attack mechanisms (basic principles and working processes), attack preconditions (such as network topology requirements, protocol weaknesses, and node status), attack consequences (such as network performance degradation, communication interruption, and information leakage) and key attack parameters in the knowledge base. Among them, the key parameters must directly correspond to the configuration or script commands of the EXata simulator, and clearly define their names, data types, value ranges, and representation methods in the simulator, including: attack type, attack source, attack target, attack strength, attack initiation time, and attack duration, and specify the specific script syntax or API call method used to configure these parameters in EXata. For example, for "interference attack", its key parameters can be specifically defined as: {attack node ID, target channel frequency, interference power, start time, duration}.
[0061] Step 102: Prompt template design.
[0062] For wireless network attack analysis tasks, analysts designed and solidified a structured prompt template to guide the analysis of the large language model. The template aims to clarify task instructions, inject domain knowledge, and standardize input and output. Its core consists of the following four parts. The system will store this template as the standard task instructions and context input when calling the large language model in the online analysis phase: (1) Basic prompts: Clearly define the role of the large language model in this analysis task (you are a professional wireless network security analysis expert) and the core task objective (your task is to analyze the following simulation scenario data, identify possible network attack behaviors, and accurately extract their key parameters), and give preliminary reasoning steps. (2) Attack knowledge: Utilize the content in the attack knowledge base. Give this part to the large language model as the knowledge background, list the known attack types, attack mechanisms, attack preconditions, attack consequences, and the list of key parameters defined in the knowledge base related to this analysis task. (3) Scenario description: Define the structured format and content fields of the input simulation scenario information. Design the required content and format in the current stage, and fill in the specific content generated by the scenario description generator in the online stage. Its description must be orderly and include key indicators: network topology and node status (node ID, location, communication link), communication services (source node, destination node, data volume), and performance indicators (latency, packet loss rate, throughput of each link). (4) Output constraints: Strictly define the output format and required fields of the large language model analysis results to ensure that the results can be automatically parsed by the subsequent system. The instructions must clearly require the listing of the identified attacks. Each attack must include the following fields: attack type, natural language analysis report (explaining the thinking process of the large language model), and all key parameters mapped from the attack knowledge section. It is prohibited to return irrelevant explanations or unstructured text.
[0063] Step 103: Simulation Data Collection: The simulation analysis system collects the runtime attributes of each node in the simulator, as follows:
[0064] Algorithm 1 Simulation Data Collection Input: Simulator real-time data stream (Sim_Data_Stream) Output: Set of simulation properties during the INFO period 1. Listening…… / *Executed by the simulation analysis system* / 2. (Packet_Log, Node_State) ←recv(Sim_Data_Stream); 3. For each packet in Packet_Log: 4. SrcID = packet.SrcID; / / Source address 5. DstID = packet.DstID; / / Destination address 6. Len = packet.Length; / / Packet length 7. (idsrc, infosrc) ←map(SrcID); / / Find the attribute set of the corresponding node based on ID 8. (iddst, infodst) ←map(DstID); 9. infosrc.flow += Len; / / Statistical flow 10. infosrc.delay = calc_delay(packet); / / Statistical delay 11. infosrc.loss = calc_loss(packet); / / Statistical packet loss 12. End for 13. For each node in Node_State: 14. (id, info) ←map(node.ID); 15. info.net = node.position; / / Statistics node position 16. info.status = node.state; / / Statistics node status 17. End for 18. / * Periodically upload collected information * / 19. If (is the time to upload collected information) 20. INFO = {info1, info2, …, infoi, …, infon} 21. Send(INFO); / / Send to the prompt generator 22. Reset(INFO); / / Delete all data and reset to the initial value 23. End if 24. Return INFO
[0065] The attack analysis system can monitor traffic information in the simulator in real time (line 2). By analyzing the logs of each received data packet, the system can determine which device the packet originated from based on its IP address or ID (lines 7-8). By accumulating the size of the data packets, the system can calculate the communication overhead (flow) of the device during this period (line 9). By analyzing the send and receive timestamps of the data packets, the system can calculate the delay and packet loss rate (lines 10-11). In addition, the system can obtain the topological location (net) and running status (status) of each node during this period through node status updates (lines 13-17). The system will periodically upload the dynamic and static attributes of each node it has collected (lines 19-21) and then send them to the hint generator for the next step.
[0066] Step 104: Scene Description Generation
[0067] After the attack analysis system collects the simulation data, it will start the scenario description generator. The generator parses, filters, associates and summarizes a large amount of raw data from multiple sources (static and dynamic data from the previous step). Its core work is to extract key network state features and convert them into a natural language description of the scenario that is easy to understand and reason about using a large language model. The final generated description is a structured comprehensive report containing specific parameter values. Its specific processing and the core parameters it contains are as follows: (1) Network topology and node status: Extract basic information from static data to form a unified view at the node level. Specifically, it includes: node ID, node attributes: including the node's location coordinates (x, y, z), movement status, device type, node connection topology (communication links between nodes). (2) Communication services: Flow ID, source node, destination node, service type (such as video stream CBR, file transfer FTP), traffic characteristics (observed average packet sending rate, cumulative amount of data sent / received). (3) Network performance indicators: Aggregate and analyze performance metrics in dynamic data to evaluate network status. Specifically, it includes: latency statistics (average latency, maximum / minimum latency of critical business flows), packet loss and reliability (packet loss rate and packet arrival rate of critical business flows or links), and throughput (instantaneous throughput and average throughput of the overall network and critical links).
[0068] Step 105: Prompt Template Assembly
[0069] The detailed scenario description generated in step 2 is assembled into a complete and executable large language model prompt according to a preset template structure. Specifically, this process involves precisely filling the extracted structured parameterized description into the scenario description position of the prompt template built in the offline stage, forming a single input containing complete context, task instructions, and output specifications. The final generated complete prompt will be a structured text, the content of which is roughly as follows: "[Basic Prompt] You are a wireless network security analysis expert. Your task is to identify possible network attacks based on the following scenario description. The following is the relevant knowledge: [Attack type, attack mechanism, attack preconditions, attack consequences], and the following is the current simulation scenario data: [Network topology and node status, communication services, network performance indicators]. Please strictly follow the following format to output the analysis results: [Attack type, natural language analysis report]."
[0070] Step 106: Attacking Inference with a Large Language Model
[0071] After receiving the analysis prompts, the large language model parses the four components of the prompts, understands its own role (security analysis expert), core task (identifying attacks and extracting parameters), available attack knowledge, and the scenario data to be analyzed, and then executes its internal reasoning and analysis process, as follows:
[0072] Algorithm 2 LLM Attack Inference Input: Full_Prompt Output: LLM_Response, Natural Language Analysis Report 1. (Scene_Context, Task_List) ← Full_Prompt; / / Extract each field from the challenge. 2. / * LLM starts logical reasoning * / 3. If Reasoning(Scene_Context, Knowledge) == True 4. / * Analyze logic matching attack characteristics * / 5. / * Enter analysis mode * / 6. Report ← Generate_Report(Scene_Context, Task_List); / / Generate a report as required. 7. LLM_Response = Report; 8. End if 9. Else 10. LLM_Response = "No attack matched"; 11. End if 12. Return LLM_Response
[0073] If the large language model determines that the scene context (Scene_Context) matches the attack knowledge (Knowledge) (line 3), after verification, the large language model will calculate the anomaly indicators in the scene and the attack features in the knowledge base, and finally generate the large language model's analysis report (line 6) according to the requirements of the task list (Task_List) and feed it back to the analysis system (line 12). If no matching attack is found, it is ignored (line 10).
[0074] Step 107: Extraction of parameters for the large language model
[0075] After the analysis system receives the analysis results (including attack type and analysis report) from the large language model, it guides the large language model to transform the qualitative judgment from the previous step into attack parameters. The core of this process is: based on the identified attack type, the system retrieves the corresponding detailed parameter template from the knowledge base, and uses this template as a constraint to call the large language model again, reasoning from its analysis report and original scene data to output structured and operable key parameters, as detailed below:
[0076] Algorithm 3 Attack Parameter Extraction Input: LLM_Response analysis report, T_Param parameter extraction template Output: AR structured attack parameters 1. Attack_Type ← Extract the attack type field from LLM_Response; 2. / * Based on the attack type, find and obtain the corresponding detailed parameter extraction template * / 3. Param ← T_Param.get_param(Attack_Type); 4. If T_Param == NULL then / / No corresponding template found, attack type invalid 5. AR = {Attack type: NULL}; 6. Return AR 7. Endif 8. Prompt_Param_Extraction ← Construct hints and integrate parameters 9. AR ← Call the large language model(Prompt_Param_Extraction); 10. Return AR
[0077] The analysis system first extracts the attack type (Attack_Type) from the preliminary analysis report (LLM_Response), and then uses this as an index to search for the corresponding parameter (Param) in the parameter template (T_Param) of the attack knowledge base (lines 1-3). This template defines all the key parameters that must be extracted for this type of attack and their format (such as attack source, target, strength, start and end time).
[0078] After obtaining the template, the system uses it as the core, combined with the original scene description and preliminary analysis report, to construct a parameter extraction prompt (Prompt_Param_Extraction) and submit it again to the large language model (line 8). This prompt guides the large model to output structured parameters strictly according to the template requirements based on its previous analysis logic and original data. Finally, the large language model generates the final structured attack result AR (line 9). The returned AR is used for subsequent simulation steps. If the template is not found, an AR indicating an invalid result is returned (lines 5 and 6).
[0079] Step 108: Simulated Attack Results
[0080] This step injects and verifies the attack parameters output by the large language model in the previous step, which contain specific parameter values, in the simulator, and quantifies the actual impact of the attack by comparing the network state before and after the attack. This process will generate a set of structured simulation result records, and the key parameters involved in its input, execution and output are as follows: (1) The input is structured attack parameters, the core parameters of which include: attack type, attack source, attack target, attack strength, attack initiation time and attack duration. (2) Attack scenario construction and simulation execution: Based on the above parameters, the system dynamically constructs the attack scenario in the EXata simulator and executes the attack. (3) The output is the simulation result. After the simulation is completed, the system generates a structured result record to verify the attack effect and support subsequent analysis. The record contains at least the following parameters: latency of the attacked node, packet loss rate of the attacked service flow or link, packet arrival rate, throughput, instantaneous throughput of the overall network and key links, and average throughput.
[0081] Step 109: Update the knowledge base and templates
[0082] The complete data chain generated in this analysis process includes: simulation input data, generated prompts, the response of the large language model, the final structured attack results, and the simulation verification output results. This data will be submitted to security experts for manual review. The core of the review is to compare the natural language analysis report / parameter results output by the large language model with the real network state reflected in the simulation results, and to evaluate the accuracy of the analysis results, the rationality of parameter extraction, and the logic of attack reasoning. If the review finds deviations in the analysis results (such as false positives, false negatives, incorrect extraction of key parameters, or invalid attack mechanism inferences), the experts will combine their domain knowledge to deeply analyze the root causes of the deviations. Based on the analysis conclusions, the system will perform the following optimization operations under the guidance of the experts:
[0083] (1) Update the attack knowledge base: If the deviation is due to missing knowledge or inaccurate definition, modify or expand the entries of the corresponding attack type in the knowledge base, supplement new attack feature indicators, correct the definition or value range of key parameters, and add new attack variant templates. (2) Optimize the prompt template: If the deviation is due to the ambiguous understanding of the instructions by the large model or the non-standard output, adjust the wording, structure or constraints of the prompt template.
[0084] Through the aforementioned iterative optimization mechanism, the system can continuously learn from the results of each analysis practice, thereby making the attack knowledge base more complete, the prompt templates more accurate, and ultimately driving the subsequent automated analysis results to continuously approach the expert level, realizing the evolution of the analysis system in terms of accuracy and reliability.
[0085] This invention utilizes the powerful contextual understanding, logical reasoning, and common sense capabilities of large language models to replace traditional machine learning models, enabling automated analysis of complex network attack behaviors in large amounts of simulation data. By using prompting engineering to convert the inference output of large language models into structured attack results, it greatly improves the interpretability of attack analysis in complex and ever-changing wireless networks and significantly reduces the overhead of manual analysis.
[0086] This invention also provides a wireless network attack analysis system based on large model hinting engineering, comprising:
[0087] Attack knowledge base building unit, used to build attack knowledge base;
[0088] The prompt template design unit is used to design prompt templates;
[0089] The simulation data acquisition unit is used to acquire simulation data;
[0090] Scene description generation unit; uses the scene description generator to generate ordered natural language descriptions of large language models that are easy to analyze from simulation data;
[0091] The prompt content generation unit uses the generated ordered natural language description as a scene description and fills it into the prompt template designed in the offline stage to form complete prompt content.
[0092] The Natural Language Analysis Report Generation Unit takes the prompts and inputs them into the large language model. It outputs the natural language analysis results of the possible attack types in the current network scenario and generates a natural language analysis report describing the reasoning process.
[0093] The analysis unit extracts the list of key attack parameters corresponding to the attack knowledge base from the analysis report, constructs new prompts to guide the large language model to perform secondary reasoning, and outputs the structured key parameters corresponding to the attack type.
[0094] The simulation unit simulates the structured key parameters in the simulator and outputs the simulated network state as the result.
[0095] The update unit updates the attack knowledge base and prompt templates based on simulation results.
[0096] In summary, this invention constructs a more intelligent automated analysis system by combining a large language model with prompting engineering, enabling the analysis of wireless network attacks to meet the requirements of high-level natural language analysis. Furthermore, with the help of the large language model, this invention achieves automated analysis of complex network scenarios, shortening the time delay between network analysis and attack analysis, while reducing unnecessary manual analysis overhead on other data. Moreover, based on this, this invention reduces the overhead of human-computer interaction by introducing a scenario description generator, enabling dynamic analysis of complex networks.
[0097] This invention can make full use of multimodal temporal data from exoskeletons to improve the algorithm's ability to distinguish and adapt to different motion modes, making the exoskeleton system more efficient and compliant in complex motion scenarios.
[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.
Claims
1. A wireless network attack analysis method based on large model hinting engineering, characterized in that, include: Offline phase: Building an attack knowledge base and designing prompt templates; Online analysis phase: Collect simulation data; The scenario description generator is used to generate ordered natural language descriptions of large language models that are easy to analyze from simulation data. The generated ordered natural language description is used as a scene description and filled into the prompt template designed in the offline stage to form a complete prompt content; The prompt is input into the large language model, which outputs the natural language analysis results of the possible attack types in the current network scenario, and generates a natural language analysis report describing its reasoning process. Extract the list of key attack parameters corresponding to the attack knowledge base from the analysis report, construct new prompts to guide the large language model to perform secondary reasoning, and output the structured key parameters corresponding to the attack type. The structured key parameters are simulated in a simulator, and the simulated network state output is used as the result. The attack knowledge base and prompt templates are updated based on simulation results.
2. The wireless network attack analysis method based on large model hinting engineering according to claim 1, characterized in that, The construction of the attack knowledge base includes: extracting descriptions of wireless network attacks from publicly available network datasets, including attack preconditions, attack consequences, and key attack parameters.
3. The wireless network attack analysis method based on large model hinting engineering according to claim 1, characterized in that, The prompt template includes basic prompts, attack knowledge, scenario descriptions, and output constraints. The basic prompts are used to set the analysis roles and core tasks for the large language model. The attack knowledge is embedded and utilizes the content in the attack knowledge base. The scenario description is structured simulation scenario information, setting the structured format and content words of the input simulation scenario information. The output constraints are used to set the output format and required fields of the analysis results. Each attack must include the following fields: attack type, natural language analysis report, and all key parameters mapped from the attack knowledge section, and returning irrelevant explanations or unstructured text is prohibited.
4. The wireless network attack analysis method based on large model hinting engineering according to claim 1, characterized in that, The simulation data includes static and dynamic data from the simulation scenario. The static data includes the configuration file of the EXata simulation software, which defines the network topology, protocol stack configuration, and service traffic. The dynamic data includes runtime traffic, latency, packet loss rate, throughput, and node status information.
5. The wireless network attack analysis method based on large model hinting engineering according to claim 1, characterized in that, The simulation data is used to generate an ordered natural language description of the large language model that is easy to analyze, including: (1) Network topology and node status: extract basic information from static data to form a unified view at the node level, specifically including: node ID, node attributes: including the node's location coordinates, movement status, device type, and node connection topology; (2) Communication services: the flow ID, source node, destination node, service type, and traffic characteristics of each communication flow; (3) Network performance indicators: aggregate and analyze performance metrics in dynamic data to evaluate network conditions, specifically including: average latency, maximum / minimum latency of key service flows, packet loss rate of key service flows or links, packet arrival rate, instantaneous throughput of the network as a whole and key links, and average throughput.
6. The wireless network attack analysis method based on large model hinting engineering according to claim 1, characterized in that, Extract the list of key attack parameters from the analysis report that corresponds to the attack knowledge base, construct new hints to guide the large language model in secondary reasoning, and output the structured key parameters corresponding to this attack type, specifically including: First, extract the attack type from the analysis report, and then use this as an index to find the corresponding parameter in the parameter template of the attack knowledge base to obtain the parameter template. After obtaining the parameter template, use this template as the core, combined with the original scene description and analysis report, to construct parameter extraction prompts, and submit them to the large language model again. These prompts will guide the large language model to output structured parameters according to the template requirements based on its previous analysis logic and original data. Finally, the large language model generates the final structured attack results, which are then used for subsequent simulations.
7. The wireless network attack analysis method based on large model hinting engineering according to claim 1, characterized in that, Updating the attack knowledge base and prompt templates based on simulation results specifically includes: reviewing the simulated attack results in conjunction with the natural language analysis report of the large language model; if there are deviations in the results, analyzing the reasons; and using the scenario data, prompts, large language model responses, and simulation results from this analysis process to update the offline attack knowledge base or optimize the prompt templates. Update the attack knowledge base: If the deviation stems from missing knowledge or inaccurate definitions, modify or expand the entries for the corresponding attack types in the knowledge base, supplement new attack characteristic indicators, revise the definitions or value ranges of key parameters, and add new attack variant templates; Optimize prompt templates: If the deviation stems from ambiguity in the large model's understanding of the instructions or non-standard output, adjust the wording, structure, or output constraints of the prompt template.
8. A wireless network attack analysis system based on large model hinting engineering, implementing the method of any one of claims 1-7, characterized in that, include: Attack knowledge base building unit, used to build attack knowledge base; The prompt template design unit is used to design prompt templates; The simulation data acquisition unit is used to acquire simulation data; Scene description generation unit; uses the scene description generator to generate ordered natural language descriptions of large language models that are easy to analyze from simulation data; The prompt content generation unit uses the generated ordered natural language description as a scene description and fills it into the prompt template designed in the offline stage to form complete prompt content. The Natural Language Analysis Report Generation Unit takes the prompts and inputs them into the large language model. It outputs the natural language analysis results of the possible attack types in the current network scenario and generates a natural language analysis report describing the reasoning process. The analysis unit extracts the list of key attack parameters corresponding to the attack knowledge base from the analysis report, constructs new prompts to guide the large language model to perform secondary reasoning, and outputs the structured key parameters corresponding to the attack type. The simulation unit simulates the structured key parameters in the simulator and outputs the simulated network state as the result. The update unit updates the attack knowledge base and prompt templates based on simulation results.