LLM-based intelligent agent collaborative intrusion detection rule generation method

Abstract

This invention relates to the field of network security technology and discloses an agent-based collaborative intrusion detection rule generation method based on LLM (Large Language Model). The method includes: collecting multi-source heterogeneous data to construct an attack behavior feature graph knowledge base and a rule generation vector knowledge base, respectively, to obtain supporting information that can be directly retrieved and used by a large language model; constructing a rule generation expert agent based on the large language model, calling the knowledge base and tools to extract multi-dimensional feature information of target malicious traffic, and generating candidate intrusion detection rules; and then constructing a rule optimization expert agent based on the large language model, iteratively optimizing the candidate rules by introducing refined feature information, and outputting the optimized intrusion detection rules. This invention enables the automatic generation and optimization of intrusion detection rules in industrial control network environments where attacks are covert and external features are difficult to detect, effectively improving the accuracy and defensive capabilities of intrusion detection rule generation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for generating collaborative intrusion detection rules based on LLM (Large Language Model). Background Technology

[0002] With the rapid development of the internet and artificial intelligence, and the continuous evolution of cyberattack techniques, the harm caused by malicious network traffic is constantly increasing, becoming a significant factor threatening the security and stable operation of information systems. In critical infrastructure environments such as industrial control networks (ICS), network protocols are diverse, and the requirements for business logic are even higher. Therefore, once malicious traffic successfully enters the internal network or ICS environment, it may trigger various unauthorized operations, thereby seriously harming the stability and security of the ICS system and the reliable operation of critical infrastructure, posing a significant threat to enterprise production safety and public safety.

[0003] Current research on intrusion detection rule generation for different network environments mainly focuses on the following methods. First, there's the method of relying on security experts to manually write intrusion detection rules. This method involves experts analyzing and summarizing their experience to form a rule set. However, manual rule writing is time-consuming and costly to maintain, and rule updates depend on continuous expert participation, making it difficult to promptly cover new or variant attack traffic. Second, there are rule generation methods based on feature engineering and data mining. These methods extract features from network traffic and mine intrusion detection rules from a set of attribute structures. However, these methods are limited in the context of complex industrial control networks. Hybrid methods combine traditional methods with machine learning-based rule inference, focusing on handling heterogeneous traffic. However, this method involves multiple interconnected modules, relying on high parameter tuning costs and engineering implementation.

[0004] Conventional intrusion detection rule generation methods are difficult to fully adapt to industrial control network environments. The fundamental reason is that the traffic inside the network is different from regular Internet traffic. Its attacks are usually covert and have a latency period. Rules manually written by experts are difficult to protect against unknown attacks and are very costly. At the same time, its special malicious behaviors and traffic are not easy to detect from external characteristics, which poses new challenges to the traditional programmatic feature extraction methods of intrusion detection rules.

[0005] Large language models offer significant advantages in generative tasks, leveraging deep semantic understanding to identify latent features and rapidly adapt to different network environments based on contextual information to complete generation tasks. However, directly using large language models for specific tasks such as network traffic understanding and rule generation presents practical challenges. Large language models rely on constructing prompt words to complete tasks, cannot independently complete a full rule generation process, lack decision-making capabilities, exhibit noticeable model illusions, and perform poorly when faced with complex task decomposition and processing. Summary of the Invention

[0006] To address the aforementioned problems, the present invention aims to provide an agent-based collaborative intrusion detection rule generation method based on LLM (Linguistic Model). This method leverages the autonomous decision-making and interaction capabilities of agents in handling complex tasks, constructs a rich and efficient external knowledge base and tools around the rule generation task, and combines a large language model to generate high-quality intrusion detection rules in industrial control network environments where traffic characteristics are concealed and attack samples are difficult to obtain. This effectively improves the accuracy and defensive capabilities of intrusion detection rule generation. The technical solution is as follows:

[0007] A method for generating agent-based collaborative intrusion detection rules based on LLM includes the following steps:

[0008] S1: Building a knowledge base query engine: Integrating key attack information from multi-source heterogeneous data to build an attack behavior feature graph knowledge base, forming a graph query engine that supports hybrid retrieval; extracting standardized rule files from rule documents to build a rule specification knowledge base, forming a composite query engine based on sub-problem decomposition;

[0009] S2: Building a functional toolset: Building and encapsulating network traffic analysis tools, rule validation tools, and rule quality review tools to form callable function tool objects;

[0010] S3: Construct expert agents: Based on the task definition agent identity and prompt words, construct rule generation expert agents and rule optimization expert agents respectively;

[0011] S4: Generate candidate rules: The rule generation expert agent analyzes the input malicious traffic file, generates initial intrusion detection rules based on the analysis results, calls the rule verification tool to check the rule hit capability, and generates candidate rules that meet the requirements through iterative feedback.

[0012] S5: Optimize and output rules: The rule optimization expert agent receives the candidate rules, calls the rule quality review tool to review the quality of the candidate rules, performs iterative optimization based on the review results, and outputs the final intrusion detection rules.

[0013] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0014] 1. This invention utilizes multi-source heterogeneous data to construct an attack behavior feature graph knowledge base and a rule generation vector knowledge base, respectively; it constructs an intelligent agent based on a large language model to generate candidate intrusion detection rules; then iteratively optimizes the intrusion detection rules and outputs the final rules. This enables the automatic generation and optimization of intrusion detection rules in industrial control network environments where attacks are covert and external features are difficult to detect, effectively defending the network environment and improving the overall security of enterprises and related organizations.

[0015] 2. By leveraging the superior semantic understanding capabilities of large language models and incorporating the assistance of graph knowledge bases, this invention can better handle hidden traffic features and unique features of industrial control networks, providing data support for rule generation.

[0016] 3. This invention introduces an intelligent agent on the basis of a large language model. The intelligent agent can be deeply integrated with the knowledge base and tools. By simulating the workflow of human experts, it can autonomously plan multi-step generation tasks and decide on the completion status of the tasks. It can also iteratively optimize the rules through self-reflection, effectively avoiding model illusion and significantly improving the efficiency and quality of rule generation. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the framework for an agent-based collaborative intrusion detection rule generation method provided by the present invention.

[0018] Figure 2 A flowchart illustrating the construction process of the graph knowledge base provided by this invention.

[0019] Figure 3 The flowchart of the rule generation expert agent provided by this invention is shown.

[0020] Figure 4 The flowchart of the rule optimization expert agent provided by this invention. Detailed Implementation

[0021] The technical solutions of the present invention will now be clearly and completely described in conjunction with the accompanying drawings, so as to provide a better understanding of the concept of the present invention, the technical problem solved, the technical features constituting the technical solution, and the technical effects brought about.

[0022] To improve the accuracy and defense capabilities of intrusion detection rule generation and further enhance the security level of industrial control systems, this invention demonstrates how to understand and identify malicious traffic characteristics under conditions of scarce attack samples and concealed attack features through an LLM-based intelligent agent collaboration technical solution, thereby achieving high-quality intrusion detection rule generation in specific network environments.

[0023] The schematic diagram of the LLM-based agent cooperative intrusion detection rule generation method framework of this invention is shown below. Figure 1 As shown, the specific steps include:

[0024] S1. Create a knowledge base query engine: Integrate key attack information from multi-source heterogeneous data, construct an attack behavior feature graph knowledge base, and form a query engine that supports hybrid retrieval; extract standardized rule files from rule documents, construct a rule specification knowledge base, and form a composite query engine based on sub-problem decomposition.

[0025] Collect multi-source heterogeneous data;

[0026] Specifically, in this embodiment, multiple open-source threat intelligence websites and attack knowledge base websites are collected to obtain external knowledge that can provide data support, including ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) data on tactics and techniques, as well as regular reports from security vendors.

[0027] like Figure 2 As shown, the construction of a graph knowledge base specifically includes the following steps:

[0028] S11. Extract key attack information from open-source attack data.

[0029] The core category set defines the following seven key attack information categories: attack patterns, attack tactics, data sources, data components, countermeasures, malware, and relationships.

[0030] By filtering multi-source heterogeneous data based on the object type field, a classification index dictionary of core categories is constructed to extract seven key attack information entities.

[0031] S12. Convert the extracted key attack information into structured text.

[0032] The entity text structuring module is invoked for classification processing. In particular, for relational entities, relational text is directly constructed.

[0033] S13. Convert structured text into document objects and handle the relationships between entities.

[0034] The categorized entity data is semantically encapsulated, and multi-dimensional attributes are concatenated into natural language text to meet the input requirements of the Knowledge GraphIndex module. A Document class is instantiated, and the generated text is loaded as a document object.

[0035] S14. Construct an attack behavior feature graph knowledge base based on document objects to form a query engine that supports hybrid retrieval. For the received query messages, the query engine uses cosine similarity to quantify semantic relevance. The calculation formula is as follows:

[0036] ;

[0037] In the formula, Indicates the query text. This represents the embedding vector corresponding to the node stored in the knowledge graph. and They are respectively to The result of feeding into the embedding model 3D vector representation, similarity score The closer a value is to 1, the higher the semantic similarity. and Vector representation and The Middle Each element.

[0038] S15. Enable a hybrid query mode that includes both graphs and vectors for the graph knowledge base query engine. The query engine will simultaneously utilize vector-based semantic capture and keyword-based graph traversal, and combine the two as context. The calculation formula is as follows:

[0039] ;

[0040] In the formula, It is a context set; This is a fact triple in the global knowledge graph. It is a set of triples in the global knowledge graph; It is the head entity of the triple; For all candidate nodes, It is the highest similarity calculated based on similarity. One node; These are key entity nouns extracted based on user query keywords;

[0041] In this example, Simple GraphStore is used as the graph storage backend, the triple extraction density is 3, and the similarity retrieval threshold is... When aggregating the returned result context, a tree-structured context semantic merging strategy is used.

[0042] S16. Extract normalized rule files containing keywords from both the official and generated verified rule documents.

[0043] Iterate through the Suricata official rule document and existing rules to extract target files with the .rst extension. Use an unstructured reader (UnstructuredReader) to parse the file object instances, using the protocol representation in the filename as object metadata.

[0044] S17. Create a vectorized index for each rule file, converting the file text into a vector representation through an embedding model.

[0045] First, attempt to load an existing index from the local persistent directory using the StorageContext. If loading fails, create a new vectorized index for the rule document.

[0046] For the S16 extraction rule file object instance, the VectorStoreIndex interface is called to perform index instantiation. The file content is parsed into discrete text node sequences Nodes, and each node is embedded using a pre-defined embedding model. Mapped to high-dimensional feature vectors This establishes a bijective relationship between the text content and the vector space.

[0047] S18. Construct a composite query engine based on sub-question decomposition. Sub-question decomposition can break down a complex natural language query into sub-query engines targeting documents of different protocols. The calculation formula is as follows:

[0048] ;

[0049] In the formula, For the original complex query, For the atomic problem after decomposition, A document containing specific normalized rules for a sub-problem; ; k represents the number of subqueries after decomposition. In this example, a sub-question query engine is configured based on the vectorization of 43 original rule documents.

[0050] S19. Configure tool metadata and description information, and package the above query engines into tool objects respectively.

[0051] S2. Building a Functional Toolset: This involves building network traffic analysis tools, rule validation tools, and rule quality review tools, encapsulating these tools as function objects for the intelligent agent system to call. This includes the following steps:

[0052] S21. Build a network traffic analysis tool. The tool receives and completes the input parameter instructions, executes the Tshark program to parse the target traffic file, and thus completes feature extraction.

[0053] In this example, the tool first receives the analysis command parameters. The instruction preprocessing unit for Execution path completion, generating executable instructions Then the lexical parser shlex will Split into parameter list This method of generating analysis commands avoids invalid analysis due to missing parameters. If the analysis is successful, the parsing result is returned; if a CalledProcessError exception is caught, the error message is encapsulated as feedback information to guide the correction of the passed command parameters. .

[0054] S22. Build a rule verification tool. Initialize the environment and start the IDS (Intrusion Detection System) engine, load the target rules and replay the corresponding traffic files. The program parses the engine logs to determine the syntax and hit rate. If there is a syntax error or the hit rate is not met, the log information is aggregated and fed back.

[0055] In this example, environment initialization includes cleaning up the temporary rule base example.rule, the structured log eve.json, the alert log fast.log, and the IDS engine runtime log suricata.rule. After the engine finishes execution, the tool parses the runtime log suricata.rule to check for syntax errors and the alert log fast.log to determine the number of hits. It aggregates and returns the verification results.

[0056] S23. Construct a rule quality review tool. Rule quality dimensions include rule generalization checking, content matching overfitting checking, content matching underfitting checking, load constraint checking, and protocol constraint range checking. A rule structure score is calculated to assess rule quality, using the following formula:

[0057] ;

[0058] In the formula, Indicates the number of items to be checked. It is the first The weighting coefficient of each inspection item, This is an indicator function that indicates whether a rule passes the check. If the score is below a threshold, information on failed items is aggregated and natural language feedback is returned.

[0059] S24. Encapsulate the above-mentioned functional tools into function tool objects, configure tool metadata, and make them available for the intelligent agent system to call.

[0060] The above-mentioned functional tools are object-oriented and encapsulated using FunctionTool, which configures detailed metadata for the tools. This is so that the intelligent agent can accurately understand the purpose and usage of the tools when calling them.

[0061] S3. Construct expert agents: Define different agent identities and prompt words according to different tasks, and construct rule generation expert agents and rule optimization expert agents respectively.

[0062] Specifically, in this embodiment, based on a large language model framework, intelligent agents with specific role awareness are constructed through prompt word engineering and toolsets. These expert intelligent agents include a rule generation expert intelligent agent and a rule optimization expert intelligent agent, which collaborate through a shared external knowledge base. The rule generation expert intelligent agent is defined as an "intrusion detection rule builder with deep protocol analysis capabilities," and is equipped with network traffic analysis tools and rule verification tools. The prompt words provide a clear and mandatory thought process: analysis → inference → query → generation → verification → reflection. The rule optimization expert intelligent agent is defined as a "rule quality verification and tuning expert." It is equipped with network traffic analysis tools, rule verification tools, and rule quality review tools, and the prompt words provide a multi-dimensional evaluation and feedback correction thought process, requiring a clear iterative optimization process.

[0063] S4. Generate candidate rules: The rule generation expert agent analyzes the input malicious traffic file, generates initial rules from the analysis results, checks the rule hit rate, and iteratively outputs candidate rules that meet the requirements based on the feedback results.

[0064] like Figure 3 As shown, generating candidate rules includes the following steps:

[0065] S41. The rule generation expert agent receives the input malicious traffic file, uses network traffic analysis tools to extract features, and sequentially infers the core vulnerability type, attack target, attack method, and attack vector in the traffic according to the prompts, thereby gaining a deep understanding of the attack behavior.

[0066] In this process, the agent uses the extracted features and inferred attack behaviors as query entities, dynamically calls the graph knowledge base for reasoning queries, and thus obtains deep technical descriptions and highly generalizable features.

[0067] S42. The agent, combining the above features and deep understanding, dynamically invokes the knowledge base query engine to obtain possible relevant attack features and rule syntax templates, and generates initial intrusion detection rules. .

[0068] S43. Call the rule verification tool to determine the correctness and validity of the initial intrusion detection rules, aggregate the log information and provide feedback;

[0069] The verification tool deploys initial intrusion detection rules and replays traffic files in an isolated sandbox environment. It performs syntax correctness checks by parsing the IDS engine's runtime logs, captures and extracts specific error code segments, and performs validity verification by counting the number of entries in the alarm logs. Finally, the tool aggregates syntax error details and hit data statistics into feedback.

[0070] S44. Set the number of iterations, and stipulate that iterative generation should be performed before the upper limit of the number of iterations or before obtaining a rule that meets the requirements. The formula for the iterative generation process of the rule is as follows:

[0071] ;

[0072] In the formula, It is the first Candidate rules generated in rounds of iteration For traffic context, To standardize the context of the knowledge base, The rules for failure in the previous round, This refers to the error diagnosis information returned by the previous round of verification tools; An abstract representation of the entire process of generating an intelligent agent.

[0073] S5. Iterative optimization and rule output: The rule optimization expert agent receives the candidate rules output in S4, reviews the quality of the candidate rules, iteratively optimizes them based on the review results, and outputs high-quality final rules.

[0074] like Figure 4 As shown, the iterative optimization and output of rules includes the following steps:

[0075] S51. The rule optimization expert agent receives candidate rules and corresponding malicious traffic files. Combining the characteristics of malicious traffic, it performs deep reasoning from four dimensions: false positive rate, robustness, generality, and load constraints of the rules, and constructs a rule optimization strategy.

[0076] S52. Based on the optimization strategy in S51, the expert agent optimizes the candidate intrusion detection rules and generates the optimized rules. .

[0077] S53. Use the rule quality review tool and rule verification tool to review the optimized rules, aggregate the log information and review results, and provide feedback.

[0078] S54. Set the number of iterations, and stipulate that iterative optimization is performed before the upper limit of the number of iterations or before obtaining a rule that meets the requirements. The agent aggregates the return information of those that fail to meet the rules to drive the next round of generation. The calculation formula is as follows:

[0079] ;

[0080] In the formula, It is the first The optimization rules of the wheel It is the first In this example, the round of review tool results feedback specifies 3 iterations, a maximum rule review score of 5, and a pass threshold of 3.

[0081] S55. The generated rules are vectorized and persistently stored as an external knowledge base, as described in step S16.

[0082] In summary, the LLM-based agent-based intrusion detection rule generation method provided in this application constructs a knowledge base query engine with a hybrid graph and vector query mode, combines it with a sub-problem decomposition strategy, and integrates a self-constructed toolset to provide accurate protocol specifications and attack principle context for large language models, effectively suppressing domain knowledge illusions. Furthermore, by utilizing a dual-expert agent architecture for rule generation and optimization, the process of traffic feature extraction, rule logic construction, and quality assessment is deeply decoupled. Innovatively, an iterative correction strategy based on negative feedback gradients is introduced into the agent collaboration chain, achieving the generation of high-quality intrusion detection rules and significantly improving the efficiency and practical effectiveness of rule development.

Claims

1. A method for generating agent-based collaborative intrusion detection rules based on LLM, characterized in that, Includes the following steps: S1: Building a knowledge base query engine: Integrating key attack information from multi-source heterogeneous data to build an attack behavior feature graph knowledge base, forming a graph query engine that supports hybrid retrieval; extracting standardized rule files from rule documents to build a rule specification knowledge base, forming a composite query engine based on sub-problem decomposition; S2: Building a functional toolset: Building and encapsulating network traffic analysis tools, rule validation tools, and rule quality review tools to form callable function tool objects; S3: Construct expert agents: Based on the task definition agent identity and prompt words, construct rule generation expert agents and rule optimization expert agents respectively; S4: Generate candidate rules: The rule generation expert agent analyzes the input malicious traffic file, generates initial intrusion detection rules based on the analysis results, calls the rule verification tool to check the rule hit capability, and generates candidate rules that meet the requirements through iterative feedback. S5: Optimize and output rules: The rule optimization expert agent receives the candidate rules, calls the rule quality review tool to review the quality of the candidate rules, performs iterative optimization based on the review results, and outputs the final intrusion detection rules.

2. The method for generating agent-based cooperative intrusion detection rules according to claim 1, characterized in that, Step S1 includes the following steps: S11: Extract key attack information from open-source attack data; S12: Convert the extracted key attack information into structured text; S13: Convert the structured text into a document object and process the relationships between entities; S14: Construct an attack behavior feature graph knowledge base based on the document object to form a graph query engine that supports hybrid retrieval; for the received query message, the query engine uses cosine similarity to measure the semantic relevance between the query text and knowledge nodes, and the calculation formula is as follows: ； in, Indicates the query text. This represents the embedding vector corresponding to the node stored in the knowledge graph. and They are respectively to The result of feeding into the embedding model 3D vector representation; A similarity score; and Vector representation and The Middle One element; S15: Enable a query mode that combines graph and vector elements, merging vector-based semantic search results and keyword-based graph traversal results into a context set. The calculation formula is as follows: ； In the formula, It is a context set; This is a fact triple in the global knowledge graph. It is a set of triples in the global knowledge graph; It is the head entity of the triple; For all candidate nodes, The highest similarity is obtained based on similarity calculation. One node; These are key entity nouns extracted based on user query keywords; S16: Extract normalized rule files containing keywords from official and verified rule documents; S17: Create a vectorized index for each of the normalization rule document files, and convert the document text into a vector representation through an embedding model; S18: Construct a composite query engine based on sub-problem decomposition to handle complex natural language queries. This is broken down into subqueries targeting different protocol documents; the decomposition relationship is represented as follows: ； In the formula, For the original complex query, For the atomic problem after decomposition, A document containing specific normalized rules for a sub-problem; k is the number of subqueries after decomposition; S19: Configure tool metadata and description information for the graph query engine and the composite query engine, and wrap them into tool objects respectively.

3. The method for generating agent-based cooperative intrusion detection rules according to claim 1, characterized in that, Step S2 includes the following steps: S21: Build a network traffic analysis tool: By receiving and completing parameter instructions, call the tshark program to parse the target traffic file to extract features; S22: Build a rule verification tool: initialize the environment and start the intrusion detection system engine, load the target rules and replay the traffic file, parse the engine logs to determine the rule syntax and hit status, and aggregate the feedback log information; S23: Construct a rule quality review tool: check from multiple dimensions including rule generalization, content matching overfitting, content matching underfitting, load constraints, and protocol constraint range; and calculate the rule structure score according to the following formula. : ； In the formula, Indicates the number of items to be checked. It is the first The weighting coefficient of each inspection item, To indicate whether the rule has passed the first The indicator function for each item check, if the score is below the threshold, aggregates the information of the failed items and returns natural language feedback; S24: Encapsulate the network traffic analysis tool, rule verification tool, and rule quality review tool into function tool objects, and configure the tool metadata for the intelligent agent system to call.

4. The method for generating agent-based cooperative intrusion detection rules according to claim 1, characterized in that, Step S4 includes the following steps: S41: The rule generation expert agent receives the input malicious traffic file, calls the network traffic analysis tool to extract features, and infers the core vulnerability type, attack target, attack method and attack vector in the traffic according to the prompts. S42: Based on the inferred attack behavior characteristics, dynamically invoke the knowledge base query engine to obtain relevant attack characteristics and rule syntax templates, and generate initial intrusion detection rules. ; S43: Invoke the rule verification tool to initialize the intrusion detection rules. Perform correctness and validity verification, and obtain aggregated verification feedback information; S44: Within a preset number of iterations, iterative generation is performed based on verification feedback. The generation process is represented as follows: ； In the formula, It is the first Candidate rules generated in rounds of iteration For traffic context, To standardize the context of the knowledge base, The rules for failure in the previous round, This refers to the error diagnosis information returned by the previous round of verification tools; An abstract representation of the entire process of generating an intelligent agent.

5. The method for generating agent-based cooperative intrusion detection rules according to claim 4, characterized in that, Step S5 includes the following steps: S51: The rule optimization expert agent receives candidate rules and their corresponding malicious traffic files. Combining the characteristics of malicious traffic, it performs deep reasoning from four dimensions: false alarm rate, robustness, generality, and load constraints of the rules, and constructs a rule optimization strategy. S52: Optimize the candidate rules according to the optimization strategy to generate optimized rules. ; S53: Invoke the rule quality review tool and rule verification tool to optimize the rules. Conduct reviews and obtain aggregated review feedback information; S54: Within a preset number of iterations, iterative optimization is performed based on review feedback. The optimization process is represented as follows: ； In the formula, It is the first The optimization rules of the wheel It is the first Feedback on the results of the review tool; S55: Vectorize the final generated intrusion detection rules and persist them to an external knowledge base.

Images