Digital asset anomaly detection method based on large language model and related product

Abstract

The invention discloses a digital asset anomaly detection method based on a large language model and a related product, and belongs to the technical field of gateway equipment anomaly detection. The invention provides a digital asset anomaly detection method based on a large language model, and the method comprises the steps: collecting multi-source data of a plurality of time windows of a gateway device in a normal operation state, and constructing a digital asset original data set; based on the original data set of the digital assets, in combination with a pre-trained large language model, obtaining a behavior semantic feature vector of the gateway-based equipment in a normal operation state, and based on multi-source data of the gateway-based equipment in a current time window, in combination with the pre-trained large language model, obtaining a current behavior semantic feature vector of the gateway-based equipment; and a K-means clustering algorithm and the contour coefficient are used to determine whether the gateway equipment is abnormal in the current time window. According to the method, semantic understanding of a big language model and quantitative analysis of a clustering algorithm are fused, so that the reliability of anomaly detection of the gateway equipment is improved.

Description

Technical Field

[0001] This invention relates to the field of critical equipment anomaly detection technology, specifically to a digital asset anomaly detection method and related products based on a large language model. Background Technology

[0002] Critical information infrastructure equipment, also known as key information infrastructure equipment, is widely used in important fields such as energy, power, transportation, and industrial control. Its operating status is complex, its protocol types are diverse, and its equipment is highly heterogeneous. Any anomalies or security incidents can have serious impacts on production safety and social operations. Therefore, accurate anomaly detection of critical information infrastructure equipment is a crucial requirement in the fields of information security and asset management.

[0003] Current methods for detecting anomalies in critical devices mainly rely on manual rule configuration, static fingerprint matching, or statistical analysis of single data features. These methods typically require pre-defining device types, communication protocols, and anomaly rules, making them ill-suited for scenarios involving frequent changes in critical device models, dynamic configuration adjustments, and complex cross-system interactions. They suffer from problems such as coarse-grained modeling, weak semantic understanding, reliance on experience for anomaly identification, and high false positive and false negative rates. Especially in scenarios with multiple data sources, they struggle to effectively characterize the relationships and contextual semantic features between critical device behaviors, leading to insufficient reliability in anomaly detection.

[0004] Therefore, how to utilize multi-source data to improve the reliability of anomaly detection in key equipment has become a technical challenge that urgently needs to be overcome by those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a digital asset anomaly detection method and related products based on a large language model, so as to overcome the problem of insufficient reliability of existing key equipment anomaly detection methods.

[0006] The present invention solves the above-mentioned technical problems through the following technical solution: This invention provides a digital asset anomaly detection method based on a large language model, comprising the following steps: Step 1: Obtain the identifier of the key-base device, collect multi-source data from multiple time windows of the key-base device under normal operating conditions, associate the multi-source data with the identifier of the key-base device, and construct the original data set of digital assets; Step 2: Preprocess the original digital asset dataset to obtain a preprocessed set of original digital asset datasets; perform semantic abstraction transformation on the preprocessed dataset to map it into a set of behavior description units; input the set of behavior description units into a pre-trained large language model to obtain the behavioral semantic feature vector of the key-based device under normal operating conditions. ; Step 3: Obtain multi-source data of the key-based device within the current time window, perform semantic abstraction and transformation after preprocessing to generate behavioral description units of the key-based device within the current time window, and input the behavioral description units of the key-based device within the current time window into a pre-trained large language model to obtain the semantic feature vector of the key-based device's current behavior. ; Step 4: Obtain the behavioral semantic feature vector of the key device under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

[0007] A further improvement of this invention is that the multi-source data includes at least static asset information, network communication data, and operational status data; static asset information is collected by interacting with the key-based device or actively scanning the key-based device; network communication data is collected by passively monitoring the key-based device; and operational status data is collected by reading the status of the key-based device or subscribing to the key-based device interface.

[0008] A further improvement of this invention is that the multi-source data also includes behavior log data, which is collected by subscribing to, pulling, forwarding or proxying logs from relevant devices.

[0009] A further improvement of the present invention is that, when the key-based device does not have any abnormalities in the current time window, it also includes the following steps: iteratively updating the multi-source data of the key-based device in the current time window in step one under normal operation based on the multi-source data of the key-based device obtained in step three.

[0010] A further improvement of this invention lies in the preprocessing of the original digital asset data set, specifically as follows: Perform at least one of the following processing on the multi-source data of key devices in the original data set of digital assets: structural normalization, time alignment, and semantic enhancement.

[0011] A further improvement of this invention is that the contour coefficient is specifically:

[0012] in, For the profile coefficient, for The average degree of dissimilarity to other points within the same cluster; for The minimum value of the average dissimilarity to other clusters; max{} is the function to find the maximum value.

[0013] This invention also provides a digital asset anomaly detection system based on a large language model, comprising: The first module is used to obtain the identifier of the key-base device, collect multi-source data of the key-base device in multiple time windows under normal operation, associate the multi-source data with the identifier of the key-base device, and construct the original data set of digital assets. The second module is used to preprocess the original digital asset data set to obtain a preprocessed original digital asset data set; to perform semantic abstraction transformation on the preprocessed original digital asset data set, mapping it to a set of behavior description units; and to input the set of behavior description units into a pre-trained large language model to obtain the behavior semantic feature vector of the key-based device under normal operating conditions. ; The third module acquires multi-source data of the key-based device within the current time window. After preprocessing, it performs semantic abstraction and transformation to generate behavioral description units of the key-based device within the current time window. These behavioral description units are then input into a pre-trained large language model to obtain the semantic feature vector of the key-based device's current behavior. ; The fourth module is used to obtain the behavioral semantic feature vectors of key devices under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

[0014] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the digital asset anomaly detection method based on the large language model described above.

[0015] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the digital asset anomaly detection method based on the large language model described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the digital asset anomaly detection method based on a large language model as described above.

[0017] Compared with the prior art, the positive and progressive effects of the present invention are as follows: The digital asset anomaly detection method based on a large language model provided by this invention constructs a raw digital asset data set by acquiring key device identifiers and associating them with multi-source data, providing a unified input for subsequent analysis. By preprocessing the multi-source data of key devices and performing semantic abstraction transformation, the preprocessed raw digital asset data set is mapped to a set of behavioral description units, improving the abstraction level of the multi-source data and facilitating the capture of high-level semantics. The set of behavioral description units is then input into a pre-trained large language model to generate behavioral semantic feature vectors. By leveraging the contextual understanding capabilities of a large language model, behavioral semantic feature vectors of the normal behavior of key-based devices under normal operating conditions are extracted, enhancing the semantic association characterization. Furthermore, by generating behavioral description units of the key-based devices within the current time window and inputting them into the large language model, the current behavioral semantic feature vector of the key-based devices is obtained. This ensures real-time detection in dynamic environments; it uses K-means clustering algorithm and silhouette coefficient to determine whether there are anomalies in the key device in the current time window; it uses K-means clustering algorithm to automatically quantify the distribution density and separation of feature vectors, avoiding reliance on manual rules, improving the objectivity and adaptability of anomaly identification, and improving detection reliability, especially in multi-source data scenarios. Attached Figure Description

[0018] The accompanying drawings are provided to further understand the invention and constitute a part of this invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0019] Figure 1 This is a flowchart illustrating a digital asset anomaly detection method based on a large language model. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In the description of this invention, it should be understood that the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0022] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] It should be understood that although terms such as first, second, third, etc., may be used in the embodiments of the present invention to describe the preset range, these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from one another. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0024] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0025] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. This is an explanation of the present invention and not a limitation thereof.

[0026] See Figure 1 This invention provides a digital asset anomaly detection method based on a large language model, comprising the following steps: Step 1: Obtain the identifier of the key-base device, collect multi-source data from multiple time windows of the key-base device under normal operating conditions, associate the multi-source data with the identifier of the key-base device, and construct the original data set of digital assets; Step 2: Preprocess the original digital asset dataset to obtain a preprocessed set of original digital asset datasets; perform semantic abstraction transformation on the preprocessed dataset to map it into a set of behavior description units; input the set of behavior description units into a pre-trained large language model to obtain the behavioral semantic feature vector of the key-based device under normal operating conditions. ; Step 3: Obtain multi-source data of the key-based device within the current time window, perform semantic abstraction and transformation after preprocessing to generate behavioral description units of the key-based device within the current time window, and input the behavioral description units of the key-based device within the current time window into a pre-trained large language model to obtain the semantic feature vector of the key-based device's current behavior. ; Step 4: Obtain the behavioral semantic feature vector of the key device under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

[0027] This invention addresses the weaknesses in semantic understanding and adaptability to dynamic changes in existing anomaly detection methods for related-base devices by integrating the semantic understanding capabilities of a large language model with the K-means clustering algorithm, thereby improving detection reliability. Specifically, the digital asset anomaly detection method based on a large language model provided by this invention constructs a raw digital asset data set by acquiring related-base device identifiers and associating them with multi-source data, providing a unified input for subsequent analysis. By preprocessing the multi-source data of related-base devices and performing semantic abstraction transformation, the preprocessed raw digital asset data set is mapped to a set of behavioral description units, enhancing the abstraction level of the multi-source data and facilitating the capture of high-level semantics. The set of behavioral description units is then input into a pre-trained large language model to generate behavioral semantic feature vectors. By leveraging the contextual understanding capabilities of a large language model, behavioral semantic feature vectors of the normal behavior of key-based devices under normal operating conditions are extracted, enhancing the semantic association characterization. Furthermore, by generating behavioral description units of the key-based devices within the current time window and inputting them into the large language model, the current behavioral semantic feature vector of the key-based devices is obtained. This ensures real-time detection in dynamic environments; it uses K-means clustering algorithm and silhouette coefficient to determine whether there are anomalies in the key device in the current time window; it uses K-means clustering algorithm to automatically quantify the distribution density and separation of feature vectors, avoiding reliance on manual rules, improving the objectivity and adaptability of anomaly identification, and improving detection reliability, especially in multi-source data scenarios.

[0028] The digital asset anomaly detection method based on a large language model proposed in this invention is applicable to various key devices, and can be specifically applied to: In the energy and power sector, key equipment in typical scenarios such as power plants, substations, power grid dispatching and distribution systems includes, but is not limited to: relay protection devices, measurement and control devices, remote terminal units, power dedicated switches, power terminals, SCADA (Supervisory Control and Data Acquisition Master Station) and its communication front-end equipment.

[0029] Industrial control and intelligent manufacturing: such as process industries, discrete manufacturing and production line automation systems. Key equipment in this field includes, but is not limited to: programmable logic controllers, distributed control systems, safety instrumented systems, industrial control hosts, industrial switches, industrial firewalls, industrial protocol gateways, fieldbus devices and edge computing nodes, etc.

[0030] In the field of cybersecurity operations and asset management, such as cybersecurity operations platforms, asset management systems, or security situation awareness systems, key equipment includes, but is not limited to, critical business servers, dedicated network equipment, security protection equipment, key node equipment in industrial and sectoral private networks, and cross-system asset management objects.

[0031] Preferably, the multi-source data includes at least static asset information, network communication data, and operational status data; static asset information is collected by interacting with the key equipment or actively scanning the key equipment; network communication data is collected by passively monitoring the key equipment; and operational status data is collected by reading the status of the key equipment or subscribing to the key equipment interface.

[0032] Static asset information is collected by interacting with key devices or actively scanning key devices. Specifically, communication is established with target key devices through methods such as network probing, protocol handshake, management interface access, or configuration query to obtain static asset information such as device model, manufacturer information, firmware or software version, network identifier, functional role, and logical address.

[0033] Network communication data is used to characterize the communication behavior and interaction patterns between key devices. Network communication data is collected by passively monitoring key devices. Specifically, it can be collected by means of port mirroring, traffic mirroring, bypass monitoring or probe deployment, etc., to collect network communication traffic generated by key devices during operation, and obtain network communication data such as communication message content, communication frequency, connection relationship and interaction direction based on industrial protocols or special protocols.

[0034] Operational status data is used to reflect the operational status and status evolution characteristics of key equipment in different time windows. Operational status data is collected by reading the status of key equipment or subscribing to the interface of key equipment. Through the management interface, monitoring interface or status reporting mechanism provided by key equipment, operational status data such as resource occupancy, status register changes and key operating indicators of key equipment are periodically obtained as needed.

[0035] Multi-source data includes at least static asset information, network communication data, and operational status data, ensuring the multi-source nature of the data, covering different dimensions, avoiding modeling bias caused by a single data source, providing rich context for subsequent semantic abstraction, and the synergistic effect of multi-source data lays a solid foundation for anomaly detection.

[0036] Preferably, the multi-source data also includes behavior log data, which is collected by subscribing to, pulling, forwarding, or proxying logs from key devices.

[0037] Behavior log data expands the range of data sources, providing more comprehensive behavioral information and ensuring the comprehensiveness and real-time nature of data collection. For key devices that support log output or event recording functions, behavior log data generated by the key devices can be obtained through log subscription, log retrieval, log forwarding, or proxy collection. Behavior log data includes operation command records, abnormal event records, system operation logs, and security-related event logs.

[0038] If the key equipment does not have log output capability, behavior log data may not be collected, and this will not affect the processing and analysis of static asset information, network communication data, and operational status data.

[0039] Preferably, when the critical device does not have any abnormalities in the current time window, the method further includes the following steps: iteratively updating the multi-source data of the critical device in the current time window based on the multi-source data of the critical device obtained in step three during the normal operation of the critical device in step one.

[0040] By introducing an iterative update mechanism, the anomaly detection method provided by this invention can dynamically adapt to changes in the behavior of critical devices. Specifically, an update is triggered when a critical device is determined to be normal, using verified data from the current time window to maintain the original data set of digital assets, thus enabling the behavioral semantic feature vector under normal operating conditions to be updated. It can continuously reflect the latest normal operating status of key equipment, improve adaptability to configuration or environmental changes, and thus enhance the accuracy and robustness of detection; when there are no anomalies in the key equipment within the current time window, it ensures that updates only occur under normal operating conditions, avoiding the contamination of behavioral semantic feature vectors under normal operating conditions by abnormal data. .

[0041] Preferably, the preprocessing of the original digital asset data set specifically includes: Perform at least one of the following processing on the multi-source data of key devices in the original data set of digital assets: structural normalization, time alignment, and semantic enhancement.

[0042] Structural normalization eliminates the heterogeneity of multi-source data by unifying the data format, facilitating subsequent processing; time alignment ensures the consistency of time series and avoids analytical bias; semantic enhancement improves the semantic information of the data, enhances the ability of large language models to capture behavioral descriptions, and makes the preprocessed multi-source data of higher quality, thereby improving the accuracy of semantic abstraction transformation and the reliability of anomaly detection.

[0043] Preferably, the contour coefficient is as follows:

[0044] in, For the profile coefficient, for The average degree of dissimilarity to other points within the same cluster; for The minimum value of the average dissimilarity to other clusters; max{} is the function to find the maximum value.

[0045] This invention also provides a digital asset anomaly detection system based on a large language model, comprising: The first module is used to obtain the identifier of the key-base device, collect multi-source data of the key-base device in multiple time windows under normal operation, associate the multi-source data with the identifier of the key-base device, and construct the original data set of digital assets. The second module is used to preprocess the original digital asset data set to obtain a preprocessed original digital asset data set; to perform semantic abstraction transformation on the preprocessed original digital asset data set, mapping it to a set of behavior description units; and to input the set of behavior description units into a pre-trained large language model to obtain the behavior semantic feature vector of the key-based device under normal operating conditions. ; The third module acquires multi-source data of the key-based device within the current time window. After preprocessing, it performs semantic abstraction and transformation to generate behavioral description units of the key-based device within the current time window. These behavioral description units are then input into a pre-trained large language model to obtain the semantic feature vector of the key-based device's current behavior. ; The fourth module is used to obtain the behavioral semantic feature vectors of key devices under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

[0046] In one embodiment of the present invention, a digital asset anomaly detection method based on a large language model includes the following steps: Step 1: Obtain the identifier of the key-base device, collect multi-source data from multiple time windows during normal operation of the key-base device, associate the multi-source data with the identifier of the key-base device, and construct the original digital asset data set. , The total number of time windows. The first A time window, The first Multi-source data of key equipment under a time window; Step 2: Preprocess the original digital asset data set to obtain the preprocessed original digital asset data set. , The first Multi-source data of key infrastructure equipment preprocessed within a time window; semantic abstraction and transformation of the preprocessed digital asset raw data set; Mapped to a set of behavioral description units , The first Behavioral description units corresponding to multi-source data of key infrastructure equipment under preprocessing within a time window; collection of behavioral description units. The input is fed into a pre-trained large language model to obtain the behavioral semantic feature vector of the key device under normal operating conditions. ; Among them, the The specific behavioral description units corresponding to the preprocessed multi-source data of key infrastructure equipment under each time window are as follows:

[0047] The main body is identified by the identification of the key equipment, which is used to identify the initiating entity of the behavior; For the purpose of action, when When triggered by operational status data, it is used to indicate changes in the status of key equipment or switching of operating modes; when When triggered by network communication data, it is used to indicate the type of communication or interaction behavior; when When triggered by behavior log data, it is used to identify specific operations or time semantics; For the target object, by The target object of the action is determined, including the communication peer device, the accessed logical address, the functional module or configuration object being operated on; For text, used to supplement The contextual semantics of the behavior include, but are not limited to, time window identifiers, communication protocol types, business stage labels, and combinations of operating environment information.

[0048] Step 3: Acquire multi-source data of key devices within the current time window, perform semantic abstraction and transformation after preprocessing, and generate behavioral description units. , behavioral description unit The input is fed into a pre-trained large language model to obtain the current behavior semantic feature vector of the key-based device. ; Step 4: Obtain the behavioral semantic feature vector of the key device under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

[0049] Based on the same inventive concept, this application provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of a digital asset anomaly detection method based on a large language model. The memory may include main memory, such as high-speed random access memory, or it may also include non-volatile memory, such as at least one disk storage device. The processor, network interface, and memory are interconnected via an internal bus, which may be an industry-standard architecture bus, a peripheral component interconnection standard bus, an extended industry-standard architecture bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory stores the program; specifically, the program may include program code, which includes computer operation instructions. The memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0050] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the digital asset anomaly detection method based on a large language model. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include RAM (Random Access Memory) and / or cache memory, etc. The non-volatile memory may include ROM (Read-Only Memory), hard disk, flash memory, optical disk, magnetic disk, etc.

[0051] Based on the same inventive concept, this application provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer device, cause the computer device to perform the steps of the above-described digital asset anomaly detection method based on a large language model.

[0052] Those skilled in the art will understand that embodiments of the present invention can be provided as methods or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM (Compact Disc Read-Only Memory), optical storage, etc.) containing computer-usable program code.

[0053] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer apparatus or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0054] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer device or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0055] These computer program instructions may also be loaded onto a computer device or other programmable data processing equipment to cause a series of operational steps to be performed on the computer device or other programmable equipment to produce a process implemented by the computer device, thereby providing instructions that execute on the computer device or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0056] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0057] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for detecting anomalies in digital assets based on a large language model, characterized in that, Includes the following steps: Step 1: Obtain the identifier of the key-base device, collect multi-source data from multiple time windows of the key-base device under normal operating conditions, associate the multi-source data with the identifier of the key-base device, and construct the original data set of digital assets; Step 2: Preprocess the original digital asset data set to obtain the preprocessed original digital asset data set; By performing semantic abstraction on the preprocessed raw digital asset data set, the preprocessed raw digital asset data set is mapped to a set of behavior description units; the set of behavior description units is then input into a pre-trained large language model to obtain the behavior semantic feature vector of the key-based device under normal operating conditions. ; Step 3: Obtain multi-source data of the key-based device within the current time window, perform semantic abstraction and transformation after preprocessing to generate behavioral description units of the key-based device within the current time window, and input the behavioral description units of the key-based device within the current time window into a pre-trained large language model to obtain the semantic feature vector of the key-based device's current behavior. ; Step 4: Obtain the behavioral semantic feature vector of the key device under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

2. The digital asset anomaly detection method based on a large language model according to claim 1, characterized in that, Multi-source data includes at least static asset information, network communication data, and operational status data; static asset information is collected by interacting with key infrastructure devices or actively scanning key infrastructure devices; network communication data is collected by passively monitoring key infrastructure devices; and operational status data is collected by reading the status of key infrastructure devices or subscribing to key infrastructure device interfaces.

3. The digital asset anomaly detection method based on a large language model according to claim 2, characterized in that, Multi-source data also includes behavior log data, which is collected by subscribing to, pulling, forwarding, or proxying logs from key devices.

4. The digital asset anomaly detection method based on a large language model according to claim 1, characterized in that, When the critical device does not have any abnormalities in the current time window, the following steps are also included: iteratively updating the multi-source data of the critical device in the current time window based on the multi-source data of the critical device obtained in step three during the normal operation of the critical device in step one.

5. The digital asset anomaly detection method based on a large language model according to claim 1, characterized in that, The preprocessing of the raw digital asset data set specifically involves: Perform at least one of the following processing on the multi-source data of key devices in the original data set of digital assets: structural normalization, time alignment, and semantic enhancement.

6. The digital asset anomaly detection method based on a large language model according to claim 1, characterized in that, The contour coefficients are as follows: in, For the profile coefficient, for The average degree of dissimilarity to other points within the same cluster; for The minimum value of the average dissimilarity to other clusters; max{} is the function to find the maximum value.

7. A digital asset anomaly detection system based on a large language model, characterized in that, include: The first module is used to obtain the identifier of the key-base device, collect multi-source data of the key-base device in multiple time windows under normal operation, associate the multi-source data with the identifier of the key-base device, and construct the original data set of digital assets. The second module is used to preprocess the original set of digital asset data to obtain a preprocessed set of original digital asset data. By performing semantic abstraction on the preprocessed raw digital asset data set, the preprocessed raw digital asset data set is mapped to a set of behavior description units; the set of behavior description units is then input into a pre-trained large language model to obtain the behavior semantic feature vector of the key-based device under normal operating conditions. ; The third module acquires multi-source data of the key-based device within the current time window. After preprocessing, it performs semantic abstraction and transformation to generate behavioral description units of the key-based device within the current time window. These behavioral description units are then input into a pre-trained large language model to obtain the semantic feature vector of the key-based device's current behavior. ; The fourth module is used to obtain the behavioral semantic feature vectors of key devices under normal operating conditions using the K-means clustering algorithm. The centroid distance is used to calculate the semantic feature vector of the current behavior of the key-based device. The profile coefficient is used as a preset threshold. If the centroid distance is used as a preset threshold, it is determined whether the profile coefficient is greater than the preset threshold. If the determination result is yes, the key equipment has an anomaly in the current time window. If the determination result is no, the key equipment does not have an anomaly in the current time window.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the digital asset anomaly detection method based on a large language model as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the digital asset anomaly detection method based on a large language model as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the digital asset anomaly detection method based on a large language model as described in any one of claims 1 to 6.

Images