Safety assistant system fused with safety big model and multi-order training system and method of safety big model

Abstract

The invention provides a security assistant system fused with a security big model and a multi-stage training system and method of the security big model, and relates to the technical field of security, comprising the steps of performing multi-stage training through field adaptability pre-training, security instruction fine tuning and expert feedback optimization, and generating the security big model, the security big model deeply masters security terms, business logic and whole-process disposal capability; the method comprises the steps of obtaining an original problem corresponding to a safety work order; obtaining output content corresponding to the original question; judging whether the output content is sensitive output information or not through the safety guardrail; based on the judgment result, determining a target answer corresponding to the original question so as to improve work order processing efficiency and shorten risk exposure time; calling an answer corpus according to the answer feedback of the target answer to construct corpus training data; and optimizing the security big model based on the corpus training data and / or the security limitation information so as to improve the processing capability of the security big model on the security work order.

Description

Technical Field

[0001] This invention relates to the field of security technology, and in particular to a security assistant system that integrates a large security model and a multi-level training system, method, electronic device, computer storage medium, and computer program product for the large security model. Background Technology

[0002] Current safety work orders are primarily processed through traditional workflows, where safety line employees dispatch work orders to business line employees. However, business line employees may encounter obstacles when actually handling these safety risks, such as: not knowing how to handle or correct them; not knowing how to verify the corrections after they are made; or being unfamiliar with relevant regulations and needing to consult a large amount of information or ask safety colleagues for help to resolve the issues.

[0003] The above situation leads to the following problems in the traditional work order processing process: (1) The processing of safety work orders requires the safety staff to follow up and answer questions at each stage, resulting in a waste of human resources; (2) Business line employees do not know how to handle them correctly, resulting in repeated communication and a waste of human resources; (3) Because the risks cannot be dealt with in a timely manner, the time for the risks to be exposed to the outside world continues to be extended, and the company will face risks such as data leakage, attacks, and compliance penalties.

[0004] This paper proposes a security assistant system that integrates a large security model, a multi-level training system and method for the large security model, electronic equipment, computer storage media, and computer program products. Summary of the Invention

[0005] This specification provides a security assistant system that integrates a large security model and a multi-level training system and method for the large security model, as well as electronic devices, computer storage media, and computer program products, to solve the technical problems of wasted human resources, low efficiency, and long risk exposure time in security work order processing.

[0006] This application provides a multi-stage training method for a secure large-scale model, which employs the following technical solution: Acquire adaptive training data in the security field; The large language model is further pre-trained using the adaptive training data to generate a pre-trained large model; The pre-trained large model is fine-tuned based on the set of security instructions to generate a fine-tuned large model. Input the test sample into the fine-tuned large model and obtain the test output content; The feedback instruction corresponding to the test output is retrieved, an incremental learning mechanism is introduced, the fine-tuned large model is optimized by reinforcement learning and a safety barrier is set to generate a safety large model; the safety large model is used to receive questions in the security domain and output corresponding answers, and the output process of the answers is judged by the safety barrier for sensitive information.

[0007] This application provides a method for applying a security assistant that integrates a large security model. The method employs the following technical solution: a security assistant is constructed based on the large security model obtained through the aforementioned multi-stage training method. The security assistant is used to assist in the management of security work orders, including: Obtain the original issue corresponding to the safety work order; The security model is invoked to output the target answer corresponding to the original question. Based on the response feedback to the target answer, retrieve the response corpus to construct the corpus training data; The security big model is optimized based on the corpus training data and / or security constraint information.

[0008] Optionally, the step of calling the security big model to output the target answer corresponding to the original question includes: Obtain the output content corresponding to the original question; The safety barrier is used to determine whether the output content is sensitive information. If the output content is sensitive output information, then the sensitive output information is intercepted; Obtain the human solution information corresponding to the original question, and use it as the target answer; If the output content is not sensitive output information, then the output content will be used as the target answer; Optionally, the step of retrieving the response corpus based on the response feedback of the target response to construct the corpus training data includes: Obtain the response feedback corresponding to the target answer; If the response is the first level of satisfaction, then the target response and general information are mixed to generate training data. If the response feedback is a second level of satisfaction, then an optimized response is given based on the original question, and the corpus training data is determined based on the length information of the optimized response.

[0009] Optionally, if the response feedback is a second satisfaction feedback, then an optimized answer is given based on the original question, and the corpus training data is determined based on the length information of the optimized answer, including: If the response feedback is the second satisfaction feedback, then obtain the optimized response output by the security big model corresponding to the original question; Determine whether the optimized response is a long text; If the optimized answer is a long text, then the corpus is decomposed based on the optimized answer to generate the corpus training data; If the optimized answer is not a long text, then the corpus training data is generated based on the optimized answer and the general information.

[0010] Optionally, the security limitation information includes basic regulatory information and multi-dimensional risk information; Optionally, optimizing the security big model based on the corpus training data and / or security constraint information includes: The training data of the corpus is collected in real time and fed back as new knowledge to the security big model. The basic regulations information is acquired in real time, and the security model is incrementally updated based on an incremental learning mechanism. The multi-dimensional risk information is collected, and the security model is updated incrementally on a regular basis.

[0011] This application provides a multi-stage training system for a secure large-scale model, which employs the following technical solution: The training data acquisition module is used to acquire adaptive training data in the security domain. An adaptive training module is used to further pre-train the large language model using the adaptive training data to generate a pre-trained large model. The fine-tuning training module is used to fine-tune the pre-trained large model based on a set of security instructions, and generate a fine-tuned large model. The test data acquisition module is used to input test samples into the fine-tuned large model and obtain test output content; The reinforcement training module is used to retrieve feedback instructions corresponding to the test output, introduce an incremental learning mechanism, perform reinforcement learning optimization on the fine-tuned large model, set a security guardrail, and generate a security large model. The security large model is used to receive questions in the security domain and output corresponding answers, and the output process of the answers is judged by the security guardrail to determine sensitive information.

[0012] The security assistant system that integrates a large security model provided in this application adopts the following technical solution: based on the security model obtained by the aforementioned multi-stage training system, a security assistant with professional security capabilities is constructed, including at least: a work order information acquisition module, a work order information output module, a corpus construction module, and an optimization module. The work order information acquisition module is used to acquire the original problem corresponding to the safety work order; The work order information output module is used to call the safety big model to output the target answer corresponding to the original question; The corpus construction module is used to construct corpus training data by retrieving the response corpus based on the response feedback of the target answer. Specifically, the response feedback corresponding to the target answer is obtained through the feedback acquisition submodule. If the response feedback is a first satisfaction feedback, the corpus construction submodule mixes the target answer with general information to generate corpus training data. If the response feedback is a second satisfaction feedback, the corpus decomposition submodule provides an optimized answer based on the original question, and the corpus training data is determined based on the length information of the optimized answer. An optimization module is used to optimize the security big model based on the corpus training data and / or security constraint information.

[0013] Optionally, the work order information output module includes: an output content acquisition submodule, a judgment submodule, and an information output submodule; The output content acquisition submodule is used to acquire the output content corresponding to the original question; The judgment submodule is used to determine whether the output content is sensitive output information through the security guardrail; The information output submodule is used to determine the target answer corresponding to the original question based on the judgment result; Optionally, the information output submodule includes: The first output unit is configured to intercept sensitive output information if the output content is sensitive output information; and to obtain the human solution information corresponding to the original question as the target answer. The second output unit is used to take the output content as the target answer if the output content is not sensitive output information. Optionally, the corpus decomposition submodule includes: An optimized answer acquisition unit is used to acquire the optimized answer corresponding to the original question output by the security big model if the answer feedback is the second satisfaction feedback. A long text determination unit is used to determine whether the optimized answer is a long text; The corpus decomposition unit is used to decompose the corpus based on the optimized answer if the optimized answer is a long text, and generate the corpus training data. The corpus mixing unit is used to generate the corpus training data based on the optimized answer and the general information if the optimized answer is not a long text.

[0014] Optionally, the security limitation information includes basic regulatory information and multi-dimensional risk information; Optionally, the optimization module includes: The corpus optimization submodule is used to collect the corpus training data in real time and feed it back as new knowledge to the security big model. The incremental learning submodule is used to acquire the basic specification information in real time and incrementally update the security big model based on the incremental learning mechanism. The periodic update submodule is used to collect the multi-dimensional risk information and perform periodic incremental updates to the security big model.

[0015] This specification also provides a computer device, wherein the computer device includes: Processor; and, A memory that stores computer-executable instructions, which, when executed, cause the processor to perform any of the methods described above.

[0016] This specification also provides a computer-readable storage medium that stores one or more programs / instructions that, when executed by a processor, implement any of the methods described above.

[0017] This specification also provides a computer program product, wherein the computer program product includes: a computer program / instruction, which, when executed by a processor, implements any of the methods described above.

[0018] In this invention, a multi-stage training process is employed, involving domain-adaptive pre-training, security instruction fine-tuning, and expert feedback optimization, to generate a comprehensive security model. This model deeply understands security terminology, business logic, and end-to-end handling capabilities. The process involves: acquiring the original question corresponding to the security work order; obtaining the output content corresponding to the original question; determining whether the output content is sensitive information using security safeguards; and, based on the determination result, identifying the target answer to the original question. This allows business line employees to process the question quickly, reducing communication wait times and shortening risk exposure time, balancing efficiency and security. Furthermore, the system constructs training data by retrieving response corpus based on the response feedback from the target answer. Finally, the comprehensive security model is optimized based on the training data and / or security constraint information to improve its ability to process security work orders. Attached Figure Description

[0019] Figure 1 A schematic diagram illustrating the principle of a multi-stage training method for a secure large model provided in the embodiments of this specification; Figure 2 This is a schematic diagram illustrating the interaction between security line staff and business line staff, provided as an embodiment of this specification. Figure 3 A schematic diagram illustrating the principle of an application method for a security assistant that integrates a large security model, as provided in the embodiments of this specification; Figure 4 A flowchart illustrating an application method for a security assistant that integrates a large security model, as provided in the embodiments of this specification; Figure 5 A schematic diagram illustrating a problem recommendation for an application method of a security assistant that integrates a large security model, as provided in the embodiments of this specification; Figure 6 A schematic diagram illustrating the output content of an application method for a security assistant that integrates a large security model, as provided in the embodiments of this specification. Figure 7 A schematic diagram of a feedback button for an application method of a security assistant that integrates a large security model, provided in an embodiment of this specification. Figure 8 A schematic diagram illustrating the application of the safety big model provided in the embodiments of this specification to safety work order management; Figure 9 This specification provides a schematic diagram of the structure of a multi-stage training system for a secure large model, as illustrated in an embodiment. Figure 10 This specification provides a schematic diagram of the structure of a security assistant system that integrates a large security model, as shown in the embodiments of this specification. Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification; Figure 12 This is a schematic diagram of a computer-readable storage medium provided for an embodiment of this specification. Detailed Implementation

[0020] The following description is intended to disclose the present invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art. The basic principles of the invention defined in the following description can be applied to other embodiments, modifications, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the invention.

[0021] Exemplary embodiments of the invention will now be described more fully with reference to the accompanying drawings. While conforming to the inventive concept, the features, structures, characteristics, or other details described in a particular embodiment may be combined in one or more other embodiments in a suitable manner.

[0022] The terms “and / or” or “and / or” include all combinations of any one or more of the listed items.

[0023] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the individual through pop-up information or by asking the individual to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0024] Figure 1 A schematic diagram illustrating the principle of a multi-stage training method for a secure large model provided in the embodiments of this specification includes: S1 acquires adaptive training data in the security domain; S2 uses the adaptive training data to continue pre-training the large language model, generating a pre-trained large model; S3 fine-tunes the pre-trained large model based on the set of security instructions to generate a fine-tuned large model. S4 inputs the test sample into the fine-tuned large model and obtains the test output content; S5 retrieves the feedback instruction corresponding to the test output, introduces an incremental learning mechanism, performs reinforcement learning optimization on the fine-tuned large model, sets a safety barrier, and generates a safety large model; the safety large model is used to receive questions in the security domain and output corresponding answers, and the output process of the answers is judged by the safety barrier for sensitive information.

[0025] In the process of internal security management and operation within an enterprise, various security work orders are needed to carry out the important work of closed-loop operation and management of security risks. For example Figure 2 As shown, security line employees create security work orders and dispatch them to business line employees for processing; among them, security work orders include, but are not limited to: vulnerability remediation work orders, security compliance work orders, security alarm work orders, file distribution work orders, sensitive permission request cancellation work orders, etc.

[0026] During the process of handling safety work orders by business line employees, safety line employees need to follow up continuously, answer various questions from business line employees, and communicate repeatedly, which takes a long time. Some work orders can even take 2-3 weeks to be closed, resulting in a long period of risk exposure.

[0027] Considering that large-scale models can learn and analyze large amounts of data and provide solution suggestions, and in order to facilitate the operational management of safety work orders and improve the efficiency of business line employees in processing safety work orders, this invention provides a multi-stage training method for a large-scale safety model, which specifically includes: S1 acquires adaptive training data in the security domain; Adaptive training data includes high-quality, structured corpora specific to the security field. Specifically, adaptive training data can be obtained from publicly available security intelligence information, national security standards, industry security standards, internal corporate security policies, historical work order data, and security expert feedback.

[0028] In one embodiment of this specification, the adaptive training data includes: attack-side sample data, defense-side sample data, and business-side sample data.

[0029] The attack-side sample data contains observable features of malicious behavior, which are used in large models to extract attack patterns and correlate attack intent.

[0030] In one embodiment of this specification, the attack-side sample data includes: attack traffic sample information, virus program sample information, Trojan program sample information, abnormal process characteristics, and service fingerprint sample information. Attack traffic sample information refers to traffic data related to attack behavior in network communication. Traffic data includes, but is not limited to, PCAP packets and traffic logs. Virus program sample information includes: malicious executable files with infectious and destructive capabilities, such as file-based viruses and macro viruses. Trojan program sample information includes: malicious programs with stealth and remote control as their core objectives, such as remote control Trojans and data-stealing Trojans. Abnormal process characteristics are process activities that deviate from normal behavior at the host level. Service fingerprint sample information includes: characteristics such as the version and type of network services exposed externally, used to identify service vulnerability risks.

[0031] The defensive sample data is used to understand how to effectively defend and how to avoid secondary risks in large models.

[0032] In one embodiment of this specification, the defense-side sample data includes: sensitive data characteristics and expert emergency response logs. Sensitive data characteristics refer to business data or system information that requires key protection. Expert emergency response logs are records of expert actions and thought processes during security incident handling (e.g., handling strategies, post-incident analysis of errors).

[0033] Business-side sample data is used to provide business context knowledge and security practice experience for large models.

[0034] In one embodiment of this specification, the business-side sample data includes: business design logs and security operation logs. The business design logs consist of design documents, requirement records, etc., generated during the development and iteration of the business system. The security operation logs consist of monitoring, detection, and response records generated by the security team during daily operations after the business system goes live.

[0035] In one embodiment of this specification, network security data in the security domain is obtained through authorized access, and then preprocessed to obtain adaptive training data in the security domain. Preferably, the preprocessing includes, but is not limited to, cleaning, classification, labeling, and de-identification of sensitive data. De-identification and authorized access ensure the legality and security of the data.

[0036] By using adaptive training data, the "underlying knowledge genes" of the security field are injected into the security big model in the later stage, which solves the problem of "semantic incomprehension and logical mismatch" of the general big model for security scenarios.

[0037] S2 uses the adaptive training data to continue pre-training the large language model, generating a pre-trained large model; In one embodiment of this specification, a professional knowledge base in the security domain is built-in. Adaptive training data is added to this knowledge base, enabling the large language model to deeply master the terminology system, conceptual relationships, and logical chains of the security domain through domain-adaptive pre-training. By superimposing security domain knowledge on the capabilities of the general large language model, it acquires a deep semantic understanding capability for security domain terminology.

[0038] In one embodiment of this specification, structured risk features can also be extracted based on adaptive training data to construct a risk feature library. These risk features are fine-grained fields extracted from security data that are strongly correlated with risk analysis.

[0039] S3 fine-tunes the pre-trained large model based on the set of security instructions to generate a fine-tuned large model. S31 constructs a set of security instructions; The security instruction set includes several security instructions specific to the target scenario. The target scenario encompasses the entire process of risk discovery, remediation plan generation, and verification guidance.

[0040] Preferred types of security instructions include: risk discovery, solution generation, and verification guidance.

[0041] Among them, the security commands for risk discovery are used in the "threat perception" stage of security operations, covering scenarios such as log analysis, traffic detection, and abnormal behavior identification, to help security personnel quickly locate potential risks.

[0042] Security instructions that generate solutions are used in the "handling and execution" stage of security incidents. They generate actionable remediation / mitigation solutions for identified risks (such as vulnerability exploitation, virus infection, and data leakage), reducing reliance on human experience.

[0043] Verification guidance-type security instructions are used in the "effect confirmation" stage after security measures are implemented to verify whether the risks have been completely eliminated, whether the remediation plan is effective, and to prevent secondary attacks.

[0044] S32 constructs fine-tuning sample data based on the set of security instructions; S33 fine-tunes the pre-trained large model using the fine-tuning sample data; By inputting fine-tuning sample data into a pre-trained large model for supervised fine-tuning, the model learns to identify core intents, find risk features based on core intents, map the extracted risk features to specific risk points, and call the structured output template of the corresponding security instructions to generate initial content.

[0045] This invention uses a set of security instructions covering the entire process of risk discovery, remediation solution generation, and verification guidance to supervise and fine-tune a pre-trained large model, enabling it to decompose tasks and provide step-by-step guidance, thereby giving it the basic ability to generate initial responses.

[0046] S4 inputs the test sample into the fine-tuned large model and obtains the test output content; The test samples are data containing problem descriptions that simulate inputs to real-world security scenarios.

[0047] The test output includes: conclusions, basis, detailed steps, etc., corresponding to the test sample.

[0048] S5 retrieves the feedback instruction corresponding to the test output, introduces an incremental learning mechanism, performs reinforcement learning optimization on the fine-tuned large model, sets a safety barrier, and generates a safety large model; the safety large model is used to receive questions in the security domain and output corresponding answers, and the output process of the answers is judged by the safety barrier for sensitive information.

[0049] S51 demonstrates the test output of a fine-tuned large model to security experts; Security experts are professionals who conduct expert evaluations of model outputs based on domain knowledge.

[0050] In one embodiment of this specification, a test display page is used to show security experts the complete test output of the fine-tuned large model output.

[0051] S52 obtains feedback instructions from security experts; After showing the test output of the fine-tuned large model to the security experts, display the test feedback page; Security experts conduct multi-dimensional evaluations based on the test output. Specifically, security experts score each evaluation dimension according to the degree of matching between the test output and the actual scenario, and determine the types of errors that exist. The multi-dimensional scores and error types entered by security experts on the test feedback page are encapsulated into structured feedback instructions.

[0052] In one embodiment of this specification, the multi-dimensional evaluation includes the following dimensions: effectiveness, security, operability, and compliance. Each evaluation dimension corresponds to a score and error type.

[0053] Specifically, the validity dimension corresponds to validity scores and validity error types, which include, but are not limited to: false positives, false negatives, and conclusion bias.

[0054] The security dimension corresponds to the security score and the security error type. The security error type includes, but is not limited to: secondary risk introduction and bypassing protection.

[0055] The operability dimension corresponds to operability scores and operability error types. Operability error types include, but are not limited to: unclear steps and conflicting steps.

[0056] The compliance dimension corresponds to a compliance score and compliance error types. Compliance error types include, but are not limited to: violation of basic regulations and unauthorized operation.

[0057] S53 performs reinforcement learning optimization on the fine-tuned large model based on the feedback instructions and incremental learning mechanism to generate a safe large model.

[0058] This invention uses reinforcement learning to train the feedback instructions output by a large model by security experts, correcting erroneous associations between features and risk points. Through continuous iteration of feedback data, it gradually strengthens the accuracy of the association between risk features and risk points, prioritizing the effectiveness, security, and low risk of subsequent output solutions, and significantly improving their professional reliability.

[0059] In one embodiment of this specification, an incremental learning mechanism is introduced, which specifically includes: constructing positive or negative sample pairs from the test output based on feedback instructions, performing reinforcement learning training on the fine-tuned large model based on the incremental learning mechanism, gradually internalizing the safety boundary, and reducing the probability of generating high-risk suggestions.

[0060] S54 sets a security barrier on the output of the security model to block sensitive output information.

[0061] Sensitive output information refers to operations involving extremely high risk or sensitivity. In one embodiment of this specification, sensitive output information includes, but is not limited to, user data, company data, and personnel information.

[0062] Unlike general models, this invention improves the full-process risk handling capabilities and professional security capabilities of the security big model through a multi-stage training method that includes domain-adaptive pre-training, security instruction fine-tuning, and optimization based on security expert feedback.

[0063] Figure 3 This is a schematic diagram illustrating the principle of an application method for a security assistant that integrates a large security model, as provided in the embodiments of this specification. The security assistant is constructed based on the large security model obtained through the aforementioned multi-stage training method, and is used to assist in the management of security work orders, including: S6 retrieves the original question corresponding to the safety work order; S7 calls the security big model to output the target answer corresponding to the original question; S8 retrieves the response corpus based on the response feedback of the target answer to construct the corpus training data; S9 optimizes the security big model based on the corpus training data and / or security constraint information.

[0064] To improve the efficiency of business line employees in processing security work orders, this invention specifically integrates security work order management and operation with a large model to build a security assistant with professional security capabilities, aiming to achieve full-process risk handling.

[0065] like Figure 4 As shown, this method specifically includes: S6 retrieves the original question corresponding to the safety work order; The original question is a specific expression of the user's needs. In one embodiment of this specification, the user may specifically be a company employee, and the inquiry request made by the employee in response to a security work order is taken as the original question.

[0066] In another embodiment of this specification, problems in safety work orders are automatically identified and treated as original problems.

[0067] In yet another embodiment of this specification, such as Figure 5 As shown, problem recommendations are given based on safety work orders, and the original problem is determined according to the selection of business line employees.

[0068] S7 calls the security big model to output the target answer corresponding to the original question, which is used to assist business line employees in processing security work orders; S71 Obtains the output content corresponding to the original question; The security big data model of this invention has mastered security domain knowledge through the aforementioned progressive multi-stage training (S1-S5). In practical applications, by identifying the core intent of the original problem and mapping it to security instructions (risk discovery, solution generation, etc.), output content is generated through knowledge retrieval, logical reasoning, and structured output.

[0069] The following is a brief description of the logic for generating the output content of the security model: S711 retrieves the work order information of the safety work order; Safety work orders contain the following information: status information and description information. Status information includes: work order type and current status. Description information includes, but is not limited to: work order title, risk description, scan report, and historical interaction records.

[0070] S712 identifies risk points based on the described information; Candidate features related to the security domain are extracted from the description information. These candidate features are fine-grained fields strongly correlated with security risk analysis, extracted from the description information of security work orders, used to accurately locate risk points and support large-scale model inference. In one embodiment of this specification, several keywords are pre-constructed; the description information is segmented into words to obtain several short texts; and the short texts containing the keywords are used as candidate features.

[0071] The candidate features are matched with a risk feature library to determine risk points. Specifically, the degree of matching between the candidate features and the risk features in the risk point feature library is determined. If the degree of matching reaches a preset matching threshold, the risk feature matched by the candidate feature is identified as the target risk feature. The risk point corresponding to the target risk feature is taken as the risk point of the safety work order.

[0072] S713 identifies the core intent of the original question; Specifically, semantic analysis is performed on the original question to identify its core intent.

[0073] S714 generates an initial response related to the risk point based on the core intent; S714-1 matches the corresponding security instructions based on the core intent. In one embodiment of this specification, if the original question is: What is the problem with this work order?, the corresponding core intent is: Identify work order risks. The security instruction corresponding to this core intent is: Risk discovery type. If the original question is: How should this vulnerability be fixed?, the corresponding core intent is: Obtain vulnerability remediation solutions. The security instruction corresponding to this core intent is: Solution generation type. If the original question is: Is testing required after remediation?, the corresponding core intent is: Verify the effectiveness of the remediation. The security instruction corresponding to this core intent is: Verification guidance type.

[0074] S714-2 combines the safety instruction with the risk point to generate initial content; specifically, it calls the structured output template corresponding to the safety instruction; and combines the structured output template with the risk point to generate explanatory content related to the risk point as the initial content. The initial response is then adjusted based on the current status in the work order information.

[0075] S715 summarizes the work order information and the initial response to construct the output content; When generating output content, discrete work order information and initial responses are transformed into fluent text to avoid mechanical listing, and readability is improved by adding logical connectors. In one embodiment of this specification, the following are refined: "Work Order Type: WebRTC Unauthorized Access Vulnerability (Public Network) Security Vulnerability Work Order," "Work Order Status: Pending," "Identified Risk Point: WebRTC Unauthorized Access Vulnerability (Public Network)," and "Explanatory Content: Hazards and Handling Suggestions Corresponding to the Identified Risk Point (No Action Required)" to form the following output: Figure 6 The image shows a partial response to a security ticket regarding vulnerability risks.

[0076] S72 determines whether the output content is sensitive information by using the safety barrier; The security guard is invoked to perform sensitivity checks on the output content and block sensitive output information.

[0077] Based on the judgment result, S73 determines the target answer corresponding to the original question to assist business line employees in processing safety work orders; S731 If the output content is sensitive output information, then intercept the sensitive output information; obtain the manual solution information corresponding to the original question as the target answer; Specifically, after intercepting sensitive output information, the original question is fed back to human processing. Based on the corresponding human solution information obtained by security experts, the final output of the security big model is used to obtain the target answer.

[0078] S732 If the output content is not sensitive output information, then the output content is used as the target answer.

[0079] If the output content is not sensitive information, then the output content is directly used as the final output of the security big model to obtain the target answer.

[0080] S8 retrieves the response corpus based on the response feedback of the target answer to construct the corpus training data; S81 obtains the response feedback corresponding to the target response; like Figure 7As shown, a feedback button is provided to the user; the user's satisfaction with the response data is obtained and used as feedback.

[0081] The feedback includes two levels: first satisfaction level and second satisfaction level. First satisfaction level indicates satisfaction with the response; second satisfaction level indicates dissatisfaction.

[0082] S82 If the response feedback is the first satisfaction feedback, then the target response and general information are mixed to generate corpus training data; If the response feedback is the first satisfaction feedback, then the corpus corresponding to the target response is retrieved and recorded as the target corpus; the target corpus is mixed with general information to generate corpus training data.

[0083] The general information includes, but is not limited to: basic question and answer, language comprehension, and daily conversation.

[0084] By mixing specialized and general language corpora in a specific ratio, the forgetting of general language knowledge caused by purely specialized training can be avoided. The preferred mixing ratio of specialized to general language corpora is 1:2.

[0085] S83 If the response feedback is the second satisfaction feedback, then an optimized response is given based on the original question, and the corpus training data is determined based on the length information of the optimized response.

[0086] S831 If the response feedback is the second satisfaction feedback, then obtain the optimized response corresponding to the original question output by the security big model; Specifically, the security model is invoked again to generate a new target answer corresponding to the original question, which serves as the optimized answer.

[0087] S832 determines whether the optimized answer is a long text; In one embodiment of this specification, if the total number of characters in the optimized response is greater than or equal to a preset number of characters, then the optimized response is considered to be a long text. The preset number of characters is preferably 4000.

[0088] S833 If the optimized answer is a long text, then the corpus is decomposed based on the optimized answer to generate the corpus training data; As a preferred approach, the corpus is decomposed through self-questioning (Self-QA) to generate corpus training data.

[0089] S834 If the optimized answer is not a long text, then the corpus training data is generated based on the optimized answer and the general information.

[0090] If the optimized answer is not a long text, the corpus corresponding to the optimized answer is retrieved and recorded as the target corpus; the target corpus is mixed with general information to generate corpus training data.

[0091] S9 optimizes the security big model based on the corpus training data and / or security constraint information; This invention identifies high-quality answers to the original question based on satisfaction feedback and uses them as high-quality samples for the optimization of a large-scale security model.

[0092] S91 collects the corpus training data in real time and feeds it back as new knowledge to the security big model. By intercepting and transferring extremely high-risk or sensitive operations to human intervention, and feeding back the high-quality solutions obtained from human intervention as new knowledge to the model, we can continuously enhance its ability to handle complex scenarios.

[0093] S92 obtains security constraint information and performs reinforcement learning optimization on the fine-tuned large model based on the security constraint information.

[0094] Specifically, security limitation information includes: basic regulatory information and / or multi-dimensional risk information; S921 acquires the basic regulations information in real time and updates the security big model incrementally based on the incremental learning mechanism; Basic regulations include the latest policies and regulations related to the security field. This includes publicly available security intelligence information, national security standards, industry standards, and company policies.

[0095] By injecting small amounts of data, such as new basic regulations, to rapidly and incrementally update the security model, the timeliness of its knowledge base is ensured to address the latest security threats.

[0096] S922 collects the multi-dimensional risk information and performs periodic incremental updates to the security big model.

[0097] Multi-dimensional risk information includes: security vulnerability risks of various enterprise assets (such as web applications, hosts, and middleware).

[0098] In one embodiment of this specification, the multi-dimensional risk information includes: multiple vulnerability information from a comprehensive vulnerability database based on the international CVE standard.

[0099] By regularly updating the system, potential security vulnerabilities can be identified in advance, and targeted remediation suggestions can be provided, effectively reducing the exposure of security risks to external parties.

[0100] like Figure 8As shown, during the process of handling security work orders by business line employees, the original issues of the security work orders can be directly input into the security big data model. Most work order issues can be fed back through the security big data model, enabling business line employees to quickly understand and resolve the risks in the security work orders, improving the response efficiency of security work orders, shortening the risk exposure time, significantly reducing the repetitive work of security personnel, and solving the problem of wasted manpower. Moreover, the security big data model of this invention, through multi-stage training, has a deep understanding of security terminology, business context, and handling logic, and can output actionable remediation solutions, verification methods, etc. for the original issues. This allows business line employees to directly refer to the target answers generated by the model (in non-sensitive scenarios) to quickly handle risks without repeatedly consulting security personnel for details, greatly reducing communication costs. In addition, this invention establishes a continuous self-optimization mechanism for the model based on a work order feedback closed loop, realizing the self-adaptation and capability improvement of the big data model in application, thereby further improving the processing efficiency and accuracy of security work orders.

[0101] This invention is based on a large-scale security model deployed on the intranet, incorporating security intelligence information, national security standards, industry security standards, internal enterprise security policies, historical work order processing data, security expert feedback, vulnerability databases and attack pattern knowledge bases, and training on common enterprise business issues. This model is then fully integrated with the security work order system. By combining the large-scale security model with internal enterprise security work orders, enterprise security operation management is achieved. Through deep integration with various types of internal work orders, a large-scale model manages and operates security work orders, reducing manpower input and shortening security work order processing time. A continuous feedback loop continuously optimizes the model, constantly adapting it to the enterprise's internal security development.

[0102] In one embodiment of this specification, specific application scenarios for end-to-end processing based on a security big model include, but are not limited to: using a security big model for... The system provides responses and answers to security questions, resolving most issues (≥90%); enables self-service vulnerability repair and Q&A, allowing non-professionals to independently resolve approximately 50% of low-level security vulnerabilities; analyzes security policies, highlighting key practical requirements; and provides efficient and professional support for security work order inquiries, accelerating work order processing and reducing risk exposure time.

[0103] Figure 9 This specification provides a schematic diagram of the structure of a multi-stage training system for a secure large model, as illustrated in an embodiment. The system includes: Training data acquisition module 910 is used to acquire adaptive training data in the security domain; The adaptive training module 920 is used to continue pre-training the large model using the adaptive training data to generate a pre-trained large model. The fine-tuning training module 930 is used to fine-tune the pre-trained large model based on a set of security instructions to generate a fine-tuned large model. The test data acquisition module 940 is used to input the test sample into the fine-tuned large model and acquire the test output content. The reinforcement training module 950 is used to retrieve feedback instructions corresponding to the test output content, introduce an incremental learning mechanism, perform reinforcement learning optimization on the fine-tuned large model and set a security guardrail to generate a security large model; the security large model is used to receive questions in the security domain and output corresponding answers, and the output process of the answers is judged by the security guardrail for sensitive information.

[0104] Figure 10 This is a schematic diagram of the structure of a security assistant system that integrates a large security model, provided in an embodiment of this specification. Based on the security model obtained by the aforementioned multi-stage training system, a security assistant with professional security capabilities is constructed. The system includes: a work order information acquisition module 960, a work order information output module 970, a corpus construction module 980, and an optimization module 990. The work order information acquisition module 960 is used to acquire the original problem corresponding to the safety work order; The work order information output module 970 is used to call the safety big model to output the target answer corresponding to the original question; The corpus construction module 980 is used to construct corpus training data by retrieving the response corpus based on the response feedback of the target response; The optimization module 990 is used to optimize the security big model based on the corpus training data and / or security constraint information.

[0105] Optionally, the work order information output module 970 includes: an output content acquisition submodule, a judgment submodule, and an information output submodule; The output content acquisition submodule is used to acquire the output content corresponding to the original question; The judgment submodule is used to determine whether the output content is sensitive output information through the security guardrail; The information output submodule is used to determine the target answer corresponding to the original question based on the judgment result; Optionally, the information output submodule includes: The first output unit is configured to intercept sensitive output information if the output content is sensitive output information; and to obtain the human solution information corresponding to the original question as the target answer. The second output unit is used to take the output content as the target answer if the output content is not sensitive output information. Optionally, the corpus construction module 980 includes: The feedback acquisition submodule is used to acquire the response feedback corresponding to the target response; The corpus construction submodule is used to generate corpus training data by mixing the target answer with general information if the response feedback is the first satisfaction feedback. The corpus decomposition submodule is used to provide an optimized answer based on the original question if the response feedback is the second satisfaction feedback, and to determine the corpus training data based on the length information of the optimized answer; Optionally, the corpus decomposition submodule includes: An optimized answer acquisition unit is used to acquire the optimized answer corresponding to the original question output by the security big model if the answer feedback is the second satisfaction feedback. A long text determination unit is used to determine whether the optimized answer is a long text; The corpus decomposition unit is used to decompose the corpus based on the optimized answer if the optimized answer is a long text, and generate the corpus training data. The corpus mixing unit is used to generate the corpus training data based on the optimized answer and the general information if the optimized answer is not a long text.

[0106] Optionally, the security limitation information includes basic regulatory information and multi-dimensional risk information; Optionally, the optimization module 990 includes: The corpus optimization submodule is used to collect the corpus training data in real time and feed it back as new knowledge to the security big model. The incremental learning submodule is used to acquire the basic specification information in real time and incrementally update the security big model based on the incremental learning mechanism. The periodic update submodule is used to collect the multi-dimensional risk information and perform periodic incremental updates to the security big model.

[0107] The functions of the system in this embodiment have been described in the above method embodiments. Therefore, for any parts not detailed in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.

[0108] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. The electronic device includes a memory 1101 and a processor 1102. The memory 1101 is used to store computer-executable instructions. When the computer-executable instructions are executed by the processor 1102, they can implement the steps of the above-described method embodiments.

[0109] Figure 12This is a schematic diagram of the structure of a computer-readable storage medium 1200 provided in an embodiment of this specification. The computer-readable storage medium 1200 stores one or more computer programs, which, when executed by a processor, can implement the steps of the above-described method embodiments.

[0110] This specification also provides a computer program product, including a computer program / computer executable instructions, which, when executed by a processor, can implement the steps of the above-described method embodiments.

[0111] Those skilled in the art will understand that all or part of the processes in the above method embodiments can be implemented by a computer program instructing related hardware. When the computer program is executed, it may include the processes of the embodiments of the above methods.

[0112] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A multi-stage training system for a secure large-scale model, characterized in that, include: The training data acquisition module is used to acquire adaptive training data in the security domain. An adaptive training module is used to further pre-train the large language model using the adaptive training data to generate a pre-trained large model. The fine-tuning training module is used to fine-tune the pre-trained large model based on a set of security instructions, and generate a fine-tuned large model. The test data acquisition module is used to input test samples into the fine-tuned large model and obtain test output content; The reinforcement training module is used to retrieve feedback instructions corresponding to the test output, introduce an incremental learning mechanism, perform reinforcement learning optimization on the fine-tuned large model, set safety barriers, and generate a safe large model. The security big model is used to receive questions in the security field and output corresponding answers, and the output process of the answers is judged by the security guardrail for sensitive information.

2. A security assistant system integrating a large-scale security model, characterized in that, Based on the security big model obtained by the multi-stage training system described in claim 1, a security assistant with professional security capabilities is constructed, including at least: a work order information acquisition module, a work order information output module, a corpus construction module, and an optimization module; The work order information acquisition module is used to acquire the original problem corresponding to the safety work order; The work order information output module is used to call the safety big model to output the target answer corresponding to the original question; specifically, it includes: obtaining the output content corresponding to the original question; determining whether the output content is sensitive output information through a safety guardrail; if the output content is sensitive output information, then blocking the sensitive output information; obtaining the manual solution information corresponding to the original question as the target answer; if the output content is not sensitive output information, then using the output content as the target answer. The corpus construction module is used to construct corpus training data by retrieving the response corpus based on the response feedback of the target answer; specifically, it includes: obtaining the response feedback corresponding to the target answer through the feedback acquisition submodule; if the response feedback is a first satisfaction feedback, then the corpus construction submodule mixes the corpus based on the target answer and general information to generate corpus training data; if the response feedback is a second satisfaction feedback, then the corpus decomposition submodule provides an optimized answer based on the original question, and determines the corpus training data based on the length information of the optimized answer; An optimization module is used to optimize the security big model based on the corpus training data and / or security constraint information.

3. The security assistant system with integrated security big model as described in claim 2, characterized in that, The corpus decomposition submodule includes: An optimized answer acquisition unit is used to acquire the optimized answer corresponding to the original question output by the security big model if the answer feedback is the second satisfaction feedback. A long text determination unit is used to determine whether the optimized answer is a long text; The corpus decomposition unit is used to decompose the corpus based on the optimized answer if the optimized answer is a long text, and generate the corpus training data. The corpus mixing unit is used to generate the corpus training data based on the optimized answer and the general information if the optimized answer is not a long text.

4. The security assistant system with integrated security big model as described in claim 2, characterized in that, The security restriction information includes basic regulations and multi-dimensional risk information; The optimization module includes: The corpus optimization submodule is used to collect the corpus training data in real time and feed it back as new knowledge to the security big model. The incremental learning submodule is used to acquire the basic specification information in real time and incrementally update the security big model based on the incremental learning mechanism. The periodic update submodule is used to collect the multi-dimensional risk information and perform periodic incremental updates to the security big model.

5. A multi-stage training method for a secure large-scale model, characterized in that, include: Acquire adaptive training data in the security field; The large language model is further pre-trained using the adaptive training data to generate a pre-trained large model; The pre-trained large model is fine-tuned based on the set of security instructions to generate a fine-tuned large model. Input the test sample into the fine-tuned large model and obtain the test output content; Retrieve the feedback instruction corresponding to the test output, introduce an incremental learning mechanism, perform reinforcement learning optimization on the fine-tuned large model, set safety barriers, and generate a safe large model. The security big model is used to receive questions in the security field and output corresponding answers, and the output process of the answers is judged by the security guardrail for sensitive information.

6. An application method for a security assistant that integrates a large security model, characterized in that, Based on the security big model obtained by the multi-stage training method described in claim 5, a security assistant is constructed, and the security assistant is used to assist in the management of security work orders, including: Obtain the original issue corresponding to the safety work order; The system calls the security model to output the target answer corresponding to the original question; specifically, it obtains the output content corresponding to the original question; it determines whether the output content is sensitive information through a security guardrail; if the output content is sensitive information, it blocks the sensitive output information; it obtains the manual solution information corresponding to the original question as the target answer; if the output content is not sensitive information, it uses the output content as the target answer. Based on the response feedback of the target answer, the response corpus is retrieved to construct the corpus training data; specifically, the response feedback corresponding to the target answer is obtained; if the response feedback is a first satisfaction feedback, the corpus is mixed based on the target answer and general information to generate corpus training data; if the response feedback is a second satisfaction feedback, an optimized answer is given based on the original question, and the corpus training data is determined based on the length information of the optimized answer. The security big model is optimized based on the corpus training data and / or security constraint information.

7. The application method of the security assistant with integrated security big model as described in claim 6, characterized in that, If the response feedback is a second satisfaction feedback, then an optimized answer is given based on the original question, and the corpus training data is determined based on the length information of the optimized answer, including: If the response feedback is the second satisfaction feedback, then obtain the optimized response output by the security big model corresponding to the original question; Determine whether the optimized response is a long text; If the optimized answer is a long text, then the corpus is decomposed based on the optimized answer to generate the corpus training data; If the optimized answer is not a long text, then the corpus training data is generated based on the optimized answer and the general information.

8. The application method of the security assistant with integrated security big model as described in claim 6, characterized in that, The security restriction information includes basic regulations and multi-dimensional risk information; The optimization of the security big model based on the corpus training data and / or security constraint information includes: The training data of the corpus is collected in real time and fed back as new knowledge to the security big model. The basic regulations information is acquired in real time, and the security model is incrementally updated based on an incremental learning mechanism. The multi-dimensional risk information is collected, and the security model is updated incrementally on a regular basis.

9. A computer device, characterized in that, The computer device includes: Processor; and, A memory storing computer-executable instructions, which, when executed, cause the processor to perform the method of any one of claims 5-8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs / instructions, which, when executed by a processor, implement the method as described in any one of claims 5-8.

11. A computer program product, characterized in that, Includes a computer program / instruction, which, when executed by a processor, implements the method as described in any one of claims 5-8.

Images