Large model training method in network security alarm log field
By pre-training a large language model on a cybersecurity corpus, cleaning the data, and performing multi-stage inference-enhanced supervised fine-tuning, the problem of insufficient understanding and analysis capabilities of general models in the field of cybersecurity alarm logs is solved, achieving more accurate alarm analysis and noise reduction effects.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGXI ZHUANG AUTONOMOUS REGION INFORMATION CENT (GUANGXI ZHUANG AUTONOMOUS REGION BIG DATA RES INST)
- Filing Date
- 2025-11-28
- Publication Date
- 2026-05-08
AI Technical Summary
The application of general-purpose large language models in the field of network security alarm logs lacks professional knowledge, resulting in limited comprehension, inaccurate analysis results, and the generation of erroneous information, making it difficult to adapt to complex and ever-changing network attack patterns.
We use a cybersecurity corpus for continuous pre-training, combine fuzzy hashing algorithm and TinyBERT classifier for data cleaning, formulate grading standards and perform preliminary annotation through a high-level large language model, carry out two-stage coarse-to-fine reasoning enhancement supervision fine-tuning and preference optimization, and construct expert analysis logic.
It significantly improves the model's ability to understand security terminology and scenarios, reduces false alarms such as high-risk alerts, improves the accuracy of hazard level judgment, reduces manual processing costs, and has expert-like decision-making and generalization capabilities.
Smart Images
Figure CN122001608A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method for training large models in the field of network security alarm logs. Background Technology
[0002] With the rapid development of information technology and the continuous advancement of digital transformation, network security operations centers are facing increasingly severe operational challenges. Network security threats are growing exponentially, and attack methods are constantly evolving. Various security devices, such as network traffic probes, generate massive amounts of log information, and the growth rate of this information far exceeds the capacity for manual processing. Traditional rule-based security detection mechanisms lack flexibility and struggle to cope with complex and ever-changing network attack patterns. The generated alarm logs often suffer from problems such as duplicate information, falsely high alert levels for high-risk situations, and the suppression of useful information, making it impossible for operations personnel to identify genuine security threats in a timely manner.
[0003] The rapid development of Large Language Models (LLMs) technology has brought new solutions to these challenges. Large language models demonstrate significant advantages in the field of text information processing, possessing powerful language understanding and reasoning capabilities. They can improve the efficiency and accuracy of critical security tasks such as threat detection and vulnerability analysis, and effectively reduce noise in alerts.
[0004] However, the application of general-purpose large language models in the field of network security alert logs still faces many problems. The training data for these models mainly comes from a large amount of general text, lacking in-depth learning of network security expertise and specific scenarios. This leads to the tendency for them to generate seemingly reasonable but actually erroneous or meaningless information when processing network security alerts. Secondly, network security alert logs contain a large number of technical terms, abbreviations, and specific formats, which general-purpose models may not accurately understand, resulting in limited comprehension and inaccurate analysis results. Furthermore, in real-world alert log analysis, experienced technicians typically need to perform multi-step reasoning based on information. This structured reasoning ensures the logical coherence and accuracy of the entire analysis process. General-purpose models, on the other hand, often produce fragmented or disjointed reasoning processes, failing to effectively summarize the analysis workflow for alert log tasks. Summary of the Invention
[0005] To address the aforementioned issues, this invention provides a large-scale model training method for network security alarm logs, which more accurately adapts to the analysis needs of network security alarm logs, effectively reduces noise in security alarm logs, significantly improves the model's performance in network security alarm analysis tasks, enhances the accuracy of risk level judgment, and reduces manual processing costs.
[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0007] A method for training a large model in the field of network security alert logs includes the following steps:
[0008] S1. The first language model is continuously pre-trained using a cybersecurity corpus to obtain a pre-trained model;
[0009] S2. Collect network security alarm logs, perform data preprocessing on the network security alarm logs, formulate grading standards, and perform preliminary danger level labeling on the network security alarm logs using a second language model to obtain a labeled alarm log dataset;
[0010] S3. Perform coarse-to-fine reasoning-enhanced supervision fine-tuning on the labeled alarm log dataset to obtain the policy model;
[0011] S4. Construct a preference dataset based on the analysis of error data, and optimize the model using the preference dataset to obtain the final model.
[0012] Furthermore, in step S1, the data in the cybersecurity corpus includes professional security blogs, technical reports, threat intelligence, vulnerability analysis, academic papers, local asset databases, and device manuals;
[0013] In step S1, the MinHash algorithm based on fuzzy hashing is used to perform duplicate detection on the data in the network security corpus. Feature hash signatures of the text are extracted to identify highly similar content, and duplicate or nearly duplicate text is deleted to obtain cleaned data. A binary classifier based on the TinyBERT model is constructed, and the cleaned data is screened out according to the prediction to remove irrelevant or low-relevance text data, so as to retain the corpus that is highly relevant to network security.
[0014] Further, in step S1, the corpus is trained using Qwen3-8b as the base model, and during training, the cross-entropy loss is minimized by maximizing the probability of the next word in the training corpus to obtain a pre-trained model. The pre-trained model is... The training process is as follows:
[0015] Formula (1),
[0016] in, For corpus The first in A text sequence; For corpus The first in The length of each text; For the first in the sequence Each word element; To represent its context, for position All previous morphemes; Given a context, the base model is used to predict the correct lexical units. The probability of.
[0017] Furthermore, in step S2, the data of the network security alarm log is cleaned to remove redundant information that is irrelevant to the risk level analysis, so as to retain the key fields used for security analysis. The key fields include timestamp, source IP, target IP, HTTP request body, and HTTP response body. The cleaned network security alarm log data is then converted to a standardized format to complete the data preprocessing.
[0018] Furthermore, in step S2, the grading standard, based on the specifications, classifies network security alarm events into five levels: critical, high-risk, medium-risk, low-risk, and safe.
[0019] The second language model performs semantic analysis on the content of the network security alert logs across multiple dimensions, including event type, attack outcome, importance of affected systems, and scope of event impact, to infer the danger level of each alert and assign a corresponding preliminary label. The results output by the second language model are verified, and errors in labeling are analyzed and recorded to obtain a labeled alert log dataset. This labeled alert log dataset is... .
[0020] Further, in step S3, the strategy model is obtained by the following steps:
[0021] S3.1 Perform semantic filtering on the labeled alarm log dataset to obtain an alarm log set containing different security event types;
[0022] S3.2 Input the semantic alarm log set into the second large language model, extract the analysis workflow corresponding to the type event, and form a strategy dataset;
[0023] S3.3 Perform first-stage supervised fine-tuning on the pre-trained model based on the policy dataset to obtain an optimized pre-trained model;
[0024] S3.4 Sample alarm logs that were not used to construct the policy dataset in the semantic alarm log set, and input the sampled alarm logs into the optimized pre-trained model to construct the correct set and the error set;
[0025] S3.5 Use the correct set to perform a second-stage supervised fine-tuning of the optimized pre-trained model again to obtain the policy model.
[0026] Further, in step S3.1, a pre-trained semantic embedding model bge-large-zh-v1.5 is used to vectorize the labeled alarm log dataset, so that the labeled alarm log dataset is mapped to a unified semantic space. After vectorizing the labeled alarm log dataset, HDBSCAN is used to automatically identify semantically similar alarm clusters based on the cosine similarity between vectors, and representative samples are selected within each cluster to remove semantically duplicated data and retain diverse security event semantic patterns, thereby obtaining a dataset containing logs. And record and analyze the reasons for errors A semantic alarm log set, wherein the semantic alarm log set is ,in ;
[0027] In step 3.2, an abstract analysis strategy is obtained through the analysis workflow corresponding to the type event. After reviewing and improving the abstract analysis strategy, a strategy dataset is obtained. ,in ,in, For logs; Reason for the error; Analysis workflow corresponding to the type of event;
[0028] In step 3.3, the pre-trained model is subjected to first-stage supervised fine-tuning based on the policy dataset, so that the pre-trained model can generate high-level analysis policies to obtain an optimized pre-trained model. The optimization objective of the first-stage supervised fine-tuning of the pre-trained model is expressed as:
[0029] Formula (2),
[0030] in, For log content data; Reason for the error; For policy datasets; This is a pre-trained model.
[0031] Furthermore, in step 3.4, the sampling alarm date is... , ,in, This is to sample the contents of the alarm log; The sampled alarm logs are labeled; the sampled alarm logs are input into the optimized pre-trained model described in step S3.3, and the optimized pre-trained model is prompted to generate detailed inference steps for each instance based on the event strategy. Collect the prediction results of the optimized pre-trained model, and construct a correct set and an incorrect set, wherein the correct set is... The error set is , , ,in, For log content data; For log tags; To optimize the prediction results of the pre-trained model; For the correct reasoning steps, This is an incorrect reasoning step;
[0032] In step 3.5, the strategy model is: The second-stage supervised fine-tuning of the optimized pre-trained model is represented as follows:
[0033] Formula (3),
[0034] in, For log content data; For log tags; To optimize the prediction results of the pre-trained model; For the correct set; To optimize the pre-trained model; This is the correct reasoning step in step S3.4; The correct inference steps generated by the optimized pre-trained model during the second-stage supervised fine-tuning process.
[0035] Further, in step S4, the second large language model is used as the teacher model. During the training process, cue words are designed to guide the second large language model to identify erroneous steps in the erroneous reasoning process, and to reflect on and correct the errors, in order to construct a preference dataset. The preference dataset is... , },in, For log data; The corrected reasoning steps; This is an incorrect reasoning step; This is an error set.
[0036] Furthermore, the policy model is further optimized using the preference dataset to narrow the probability gap between maximizing preference inference and non-preference inference, making the optimized model sufficiently close to the pre-trained model to obtain the final model. The final model is... The optimization process is as follows:
[0037] Formula (4),
[0038] in, It is the sigmoid function; For the final model; For strategy models; For log data; For the correct reasoning steps; This is an incorrect reasoning step; It is a hyperparameter that adjusts the degree of deviation between the final model and the policy model.
[0039] The beneficial effects of this invention are:
[0040] By establishing reasonable alarm classification standards and combining advanced large language models with manual verification mechanisms, the problem of falsely high-risk alarms and other misjudgments is effectively reduced. Continuous pre-training with high-quality cybersecurity corpora significantly improves the model's understanding of security terminology and scenarios. Using a powerful second large language model with larger parameters for initial hazard level labeling improves labeling accuracy. A two-stage, coarse-to-fine reasoning-enhanced supervision and fine-tuning process is employed: the first stage teaches the model advanced abstract analysis strategies from experts, and the second stage teaches it refined reasoning methods. This two-stage coarse-to-fine reasoning-enhanced supervision and fine-tuning strategy, along with a preference optimization mechanism, systematically constructs expert analysis logic, enabling the model to possess expert-like decision-making and generalization abilities. A preference dataset is constructed based on the analysis of error data, and the model is then optimized using this dataset. This invention significantly improves the model's performance in cybersecurity alarm analysis tasks, enhances the accuracy of hazard level judgment, reduces manual processing costs, and possesses good practicality and scalability. Compared with traditional technologies, this invention enhances the ability of large language models to more accurately adapt to the analysis needs of network security alarm logs by injecting network security knowledge and improving the ability of expert reasoning from coarse to fine, and effectively reduces noise in security alarm logs. Attached Figure Description
[0041] Figure 1 This is a flowchart of a preferred embodiment of the present invention for training a large model in the field of network security alarm logs. Detailed Implementation
[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0043] It should be noted that when a component is described as "fixed to" another component, it can be directly on the other component or may have a component in between. When a component is considered "connected to" another component, it can be directly connected to the other component or may have a component in between. When a component is considered "set on" another component, it can be directly set on the other component or may have a component in between. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.
[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.
[0045] Please see Figure 1 A preferred embodiment of the present invention provides a method for training a large model in the field of network security alarm logs, comprising the following steps:
[0046] S1. The first language model is continuously pre-trained using a cybersecurity corpus to obtain a pre-trained model.
[0047] In step S1, the data in the cybersecurity corpus includes professional security blogs, technical reports, threat intelligence, vulnerability analysis, academic papers, local asset databases, and device manuals;
[0048] In step S1, the MinHash algorithm based on fuzzy hashing is used to perform duplicate detection on the data in the cybersecurity corpus. Feature hash signatures of the text are extracted to identify highly similar content, and duplicate or nearly duplicate text is deleted to obtain cleaned data. A binary classifier based on the TinyBERT model is constructed, and the cleaned data is sorted out according to the prediction to remove irrelevant or low-relevance text data, so as to retain the corpus that is highly relevant to cybersecurity.
[0049] In step S1, the corpus is trained using Qwen3-8b as the base model. During training, the cross-entropy loss is minimized by maximizing the probability of the next word in the training corpus to obtain a pre-trained model. The pre-trained model is... The training process is as follows:
[0050] Formula (1),
[0051] in, For corpus The first in A text sequence; For corpus The first in The length of each text; For the first in the sequence Each word element; To represent its context, for position All previous morphemes; The basic model predicts the correct lexical units given the context. The probability of.
[0052] In this embodiment, considering the varying quality and relevance of texts from different sources, the MinHash algorithm based on fuzzy hashing is used to perform duplicate detection on the corpus. Feature hash signatures of the texts are extracted to identify highly similar content, and duplicate or nearly duplicate texts are removed. Continuous pre-training uses Qwen3-8b as the base model, which possesses strong Chinese language understanding and cybersecurity understanding capabilities.
[0053] S2. Collect network security alarm logs, perform data preprocessing on the network security alarm logs, formulate grading standards, and use a second language model to perform preliminary hazard level labeling on the network security alarm logs to obtain a labeled alarm log dataset.
[0054] In step S2, the network security alarm log data is cleaned to remove redundant information that is irrelevant to the risk level analysis, so as to retain the key fields used for security analysis. The key fields include timestamp, source IP, destination IP, HTTP request body, and HTTP response body. The cleaned network security alarm log data is then converted to a standardized format to complete the data preprocessing.
[0055] In step S2, the grading standard, based on the specifications, classifies network security alarm events into five levels: critical, high-risk, medium-risk, low-risk, and safe.
[0056] Based on the "Information Security Technology - Guidelines for Classification and Grading of Network Security Incidents" (GB / T 20986-2023), a grading standard is established to classify network security alarm events into five levels: critical, high-risk, medium-risk, low-risk, and safe. The criteria for determining each level are as follows:
[0057] Critical: Critically important systems have been repeatedly or severely infected, subjected to continuous attacks, or suffered massive data breaches;
[0058] High risk: Particularly critical systems have been infected in a single instance, subjected to a small number of attacks, or had a small amount of data leaked, exhibiting high-risk vulnerabilities and abnormal behavior; critical systems have been infected multiple times, subjected to multiple attacks, or had a large amount of data leaked.
[0059] Medium risk: Critical systems are subject to a single infection, a small number of attacks, and a small amount of data leakage, and have medium-risk vulnerabilities and abnormal behavior; General systems are subject to multiple infections and multiple attacks, and have a large amount of data leakage and high-risk vulnerabilities.
[0060] Low risk: Low-risk attacks or failed attack attempts, with low-risk vulnerabilities and minor information leakage, etc.
[0061] Safety: Low-frequency operations with no actual harm, and other events that do not cause actual impact.
[0062] The second language model performs semantic analysis on the content of network security alert logs across multiple dimensions, including event type, attack outcome, importance of affected systems, and scope of impact, to infer the danger level of each alert and assign a corresponding preliminary label. The results of the second language model are verified, and errors in labeling are analyzed and recorded to obtain a labeled alert log dataset. .
[0063] The second language model is more powerful than the first. It performs semantic analysis on log content from multiple dimensions, including event type, attack results, the importance of affected systems, and the scope of the event's impact, thereby inferring the danger level of each alert and assigning it a corresponding preliminary label. Finally, technical personnel verify each annotation result output by the model, analyze and record any annotation errors found, and obtain an annotated alert log dataset.
[0064] S3. Perform coarse-to-fine reasoning-enhanced supervision fine-tuning on the labeled alarm log dataset to obtain the policy model.
[0065] In step S3, the policy model is obtained by the following steps:
[0066] S3.1 Perform semantic filtering on the labeled alarm log dataset to obtain an alarm log set containing different security event types;
[0067] In step S3.1, a pre-trained semantic embedding model, bge-large-zh-v1.5, is used to vectorize the labeled alarm log dataset, mapping it to a unified semantic space. After vectorization, HDBSCAN is used to automatically identify semantically similar alarm clusters based on the cosine similarity between vectors. Representative samples are selected within each cluster to remove semantically duplicated data and retain diverse security event semantic patterns, thus obtaining a dataset containing log data. And record and analyze the reasons for errors The semantic alert log set, the semantic alert log set is ,in In step S3.1, to ensure the diversity of event types, a pre-trained semantic embedding model bge-large-zh-v1.5 is used to vectorize the labeled alarm logs.
[0068] S3.2 Input the semantic alert log set into the second large language model to extract the analysis workflow corresponding to the type events, thus forming a policy dataset. In step 3.2, all generated policies are manually reviewed and improved to obtain the policy dataset.
[0069] In step 3.2, an abstract analysis strategy is obtained through the analysis workflow corresponding to the type event. After reviewing and improving the abstract analysis strategy, a strategy dataset is obtained. ,in ,in, For log data; Reason for the error; The analysis workflow corresponding to the type of event.
[0070] S3.3 Perform first-stage supervised fine-tuning on the pre-trained model based on the policy dataset to obtain an optimized pre-trained model. In step 3.3, the first-stage supervised fine-tuning enables the optimized pre-trained model to learn to generate advanced analysis policies.
[0071] In step 3.3, the pre-trained model undergoes first-stage supervised fine-tuning based on the policy dataset to enable it to generate high-level analysis policies, thereby optimizing the pre-trained model. The optimization objective of the first-stage supervised fine-tuning of the pre-trained model is expressed as:
[0072] Formula (2),
[0073] in, For log content data; Reason for the error; For policy datasets; This is a pre-trained model.
[0074] S3.4 Sample alarm logs that were not used to build the policy dataset in the semantic alarm log set, and input the sampled alarm logs into the optimized pre-trained model to build the correct set and the error set.
[0075] In step 3.4, the sampling alarm date is... , ,in, This is to sample the contents of the alarm log; Label the sampled alarm logs; input the sampled alarm logs into step S3.3 to optimize the pre-trained model, and provide a prompt to the optimized pre-trained model to generate detailed inference steps for each instance based on the event strategy. Collect and optimize the prediction results of the pre-trained model, and construct a correct set and an incorrect set. The correct set is... The error set is , , ,in, For log content data; For log tags; To optimize the prediction results of the pre-trained model; For the correct reasoning steps, This is an incorrect reasoning step.
[0076] S3.5 Use the correct set to perform a second stage of supervised fine-tuning on the optimized pre-trained model to obtain the policy model. Step S3.5 uses the correct set to further supervise and fine-tune the model, allowing the model to learn a refined inference method to obtain the policy model.
[0077] The strategy model is The second-stage supervised fine-tuning of the optimized pre-trained model is represented as:
[0078] Formula (3),
[0079] in, For log content data; For log tags; To optimize the prediction results of the pre-trained model; For the correct set; To optimize the pre-trained model; This is the correct reasoning step in step S3.4; To optimize the correct inference steps generated by the pre-trained model during the second-stage supervised fine-tuning process.
[0080] Cybersecurity incidents can be categorized into different types, such as malware incidents, network attack incidents, data security incidents, security vulnerability incidents, and abnormal behavior incidents. These different types can be further subdivided into multiple subcategories; for example, network attack incidents include network probing and scanning incidents, backdoor implantation incidents, and APT incidents. Different security incidents yield different traffic log fields, and the key fields requiring analysis also differ. Technical personnel often employ different strategies when analyzing different types of incidents. These strategies form the basis for analyzing specific incidents. Therefore, this embodiment extracts these strategies for the model to learn, enabling the model to possess the advanced thinking of a cybersecurity expert.
[0081] S4. Construct a preference dataset based on the analysis of error data, and optimize the model using the preference dataset to obtain the final model.
[0082] In step S4, the second language model is used as the teacher model. During training, cue words are designed to guide the second language model in identifying erroneous steps in the reasoning process and to reflect on and correct these errors, thereby constructing a preference dataset. , },in, For log data; The corrected reasoning steps; This is an incorrect reasoning step; This is an error set.
[0083] The policy model is further optimized using a preference dataset to narrow the probability gap between maximizing preference inference and non-preference inference, making the optimized model sufficiently close to the pre-trained model to obtain the final model. The final model is... The optimization process is as follows:
[0084] Formula (4),
[0085] in, It is the sigmoid function; For the final model; For strategy models; For log data; For the correct reasoning steps; This is an incorrect reasoning step; It is a hyperparameter that adjusts the degree of deviation between the final model and the policy model.
[0086] Although the fine-tuning steps in step S3 have enabled the model to mimic the thinking of cybersecurity experts, it may still produce erroneous reasoning or results when faced with specific instances. To correct erroneous reasoning, step S4 employs preference learning to correct flawed reasoning.
[0087] This embodiment effectively reduces false alarms such as falsely high alert levels by establishing reasonable alarm classification standards and combining advanced large language models with manual verification mechanisms. Continuous pre-training with high-quality cybersecurity corpora significantly improves the model's understanding of security terminology and scenarios. Using a powerful second large language model with larger parameters for initial hazard level labeling improves labeling accuracy. A two-stage, coarse-to-fine reasoning-enhanced supervision and fine-tuning process is employed: the first stage teaches the model advanced abstract analysis strategies from experts, and the second stage teaches the model refined reasoning methods. This two-stage coarse-to-fine reasoning-enhanced supervision and fine-tuning strategy, along with a preference optimization mechanism, systematically constructs expert analysis logic, enabling the model to possess expert-like decision-making and generalization abilities. A preference dataset is constructed based on the analysis of error data, and the model is then optimized using this dataset.
[0088] This embodiment significantly improves the model's performance in network security alert analysis tasks, enhances the accuracy of risk level judgment, reduces manual processing costs, and possesses good practicality and scalability. Compared with traditional technologies, this embodiment enhances the large language model by injecting network security knowledge and improving expert reasoning capabilities from coarse to fine, enabling it to more accurately adapt to the analysis needs of network security alert logs and effectively reduce noise in security alert logs.
[0089] In this embodiment, the open-source Qwen3-8b model is used as the base, and the first major language model is the Qwen3-8b model; the more powerful major language model Qwen3-Plus (qwen-plus-2025-09-11) is selected for the annotation and fine-tuning process, and the second major language model is Qwen3-Plus, which is used for HTTP request interaction through API.
[0090] Training was performed on an NVIDIA RTX 4090×2 environment, using the LLaMA Factory framework for continuous pre-training and fine-tuning of the model. During continuous pre-training, a batch size of 16, a context window length of 2048, and a learning rate initialized to 3.0e-5 were used, employing a cosine learning rate scheduler for 5 epochs. For supervised fine-tuning, a batch size of 16, a context window length of 2048, a learning rate of 3.0e-5, and a cosine learning rate scheduler were used, with 5 training epochs. For DPO, the batch size was set to 4, the learning rate to 5.0e-6, and the epochs to 5. Additionally, the DPO-specific β parameter was set to 0.1. All other hyperparameters followed the default settings provided by LLaMA Factory.
Claims
1. A method for training a large model in the field of network security alarm logs, characterized in that, Includes the following steps: S1. The first language model is continuously pre-trained using a cybersecurity corpus to obtain a pre-trained model; S2. Collect network security alarm logs, perform data preprocessing on the network security alarm logs, formulate grading standards, and perform preliminary danger level labeling on the network security alarm logs using a second language model to obtain a labeled alarm log dataset; S3. Perform coarse-to-fine reasoning-enhanced supervision fine-tuning on the labeled alarm log dataset to obtain the policy model; S4. Construct a preference dataset based on the analysis of error data, and optimize the model using the preference dataset to obtain the final model.
2. The method for training a large model in the field of network security alarm logs according to claim 1, characterized in that: In step S1, the data in the cybersecurity corpus includes professional security blogs, technical reports, threat intelligence, vulnerability analysis, academic papers, local asset databases, and device manuals; In step S1, the MinHash algorithm based on fuzzy hashing is used to perform duplicate detection on the data in the network security corpus. Feature hash signatures of the text are extracted to identify highly similar content, and duplicate or nearly duplicate text is deleted to obtain cleaned data. A binary classifier based on the TinyBERT model is constructed, and the cleaned data is screened out according to the prediction to remove irrelevant or low-relevance text data, so as to retain the corpus that is highly relevant to network security.
3. The method for training a large model in the field of network security alarm logs according to claim 2, characterized in that: In step S1, the corpus is trained using Qwen3-8b as the base model. During training, the cross-entropy loss is minimized by maximizing the probability of the next word in the training corpus to obtain a pre-trained model. The pre-trained model is... The training process is as follows: Official (1), in, For corpus The first in A text sequence; For corpus The first in The length of each text; For the first in the sequence Each word element; To represent its context, for position All previous morphemes; Given a context, the base model is used to predict the correct lexical units. The probability of.
4. The method for training a large model in the field of network security alarm logs according to claim 1, characterized in that: In step S2, the network security alarm log data is cleaned to remove redundant information that is irrelevant to the risk level analysis, so as to retain the key fields used for security analysis. The key fields include timestamp, source IP, destination IP, HTTP request body, and HTTP response body. The cleaned network security alarm log data is then converted to a standardized format to complete the data preprocessing.
5. The method for training a large model in the field of network security alarm logs according to claim 1, characterized in that: In step S2, the grading standard, based on the specifications, classifies network security alarm events into five levels: critical, high-risk, medium-risk, low-risk, and safe. The second language model performs semantic analysis on the content of the network security alert logs across multiple dimensions, including event type, attack outcome, importance of affected systems, and scope of event impact, to infer the danger level of each alert and assign a corresponding preliminary label. The results output by the second language model are verified, and errors in labeling are analyzed and recorded to obtain a labeled alert log dataset. This labeled alert log dataset is... .
6. The method for training a large model in the field of network security alarm logs according to claim 1, characterized in that: In step S3, the policy model is obtained by the following steps: S3.1 Perform semantic filtering on the labeled alarm log dataset to obtain an alarm log set containing different security event types; S3.2 Input the semantic alarm log set into the second large language model, extract the analysis workflow corresponding to the type event, and form a strategy dataset; S3.3 Perform first-stage supervised fine-tuning on the pre-trained model based on the policy dataset to obtain an optimized pre-trained model; S3.4 Sample alarm logs that were not used to construct the policy dataset in the semantic alarm log set, and input the sampled alarm logs into the optimized pre-trained model to construct the correct set and the error set; S3.5 Use the correct set to perform a second-stage supervised fine-tuning of the optimized pre-trained model again to obtain the policy model.
7. The method for training a large model in the field of network security alarm logs according to claim 6, characterized in that: In step S3.1, a pre-trained semantic embedding model bge-large-zh-v1.5 is used to vectorize the labeled alarm log dataset, so that the labeled alarm log dataset is mapped to a unified semantic space. After vectorizing the labeled alarm log dataset, HDBSCAN is used to automatically identify semantically similar alarm clusters based on the cosine similarity between vectors, and representative samples are selected within each cluster to remove semantically duplicated data and retain diverse security event semantic patterns, thereby obtaining a log-containing representation. And record and analyze the reasons for errors A semantic alarm log set, wherein the semantic alarm log set is ,in ; In step 3.2, an abstract analysis strategy is obtained through the analysis workflow corresponding to the type event. After reviewing and improving the abstract analysis strategy, a strategy dataset is obtained. ,in ,in, For logs; Reason for the error; Analysis workflow corresponding to the type of event; In step 3.3, the pre-trained model is subjected to first-stage supervised fine-tuning based on the policy dataset, so that the pre-trained model can generate high-level analysis policies to obtain an optimized pre-trained model. The optimization objective of the first-stage supervised fine-tuning of the pre-trained model is expressed as: Official (2), in, For log content data; Reason for the error; For policy datasets; This is a pre-trained model.
8. The method for training a large model in the field of network security alarm logs according to claim 7, characterized in that: In step 3.4, the sampling alarm date is... , ,in, This is to sample the contents of the alarm log; The sampled alarm logs are labeled; the sampled alarm logs are input into the optimized pre-trained model described in step S3.3, and the optimized pre-trained model is prompted to generate detailed inference steps for each instance based on the event strategy. Collect the prediction results of the optimized pre-trained model, and construct a correct set and an incorrect set, wherein the correct set is... The error set is , , ,in, For log content data; For log tags; To optimize the prediction results of the pre-trained model; For the correct reasoning steps, This is an incorrect reasoning step; In step 3.5, the strategy model is: The second-stage supervised fine-tuning of the optimized pre-trained model is represented as follows: Official (3), in, For log content data; For log tags; To optimize the prediction results of the pre-trained model; For the correct set; To optimize the pre-trained model; This is the correct reasoning step in step S3.4; The correct inference steps generated by the optimized pre-trained model during the second-stage supervised fine-tuning process.
9. The method for training a large model in the field of network security alarm logs according to claim 8, characterized in that: In step S4, the second large language model is used as the teacher model. During the training process, cue words are designed to guide the second large language model to identify erroneous steps in the erroneous reasoning process, and the errors are reflected upon and corrected to construct a preference dataset. The preference dataset is... , },in, For log data; The corrected reasoning steps; This is an incorrect reasoning step; This is an error set.
10. The method for training a large model in the field of network security alarm logs according to claim 9, characterized in that: The policy model is further optimized using the preference dataset to narrow the probability gap between maximizing preference inference and non-preference inference, making the optimized model sufficiently close to the pre-trained model to obtain the final model. The final model is... The optimization process is as follows: Official (4), in, It is the sigmoid function; For the final model; For strategy models; For log data; For the correct reasoning steps; This is an incorrect reasoning step; It is a hyperparameter that adjusts the degree of deviation between the final model and the policy model.