Web vulnerability attack type identification method, device and equipment based on large language model and medium

Abstract

Embodiments of the present application relate to the field of network security protocol vulnerability attack identification, and particularly relate to a Web vulnerability attack type identification method, device, equipment and medium based on a large language model. A specific implementation of the method includes: inputting pre-acquired Web vulnerability attack data into a behavior accurate identification task template included in a multi-task prompt response template library to obtain behavior accurate identification task information; performing greedy sampling inference processing on the behavior accurate identification task information to obtain at least one inference result; based on the multi-task prompt response template library, performing standardized processing on the Web vulnerability attack data to obtain Web standardized text; inputting the Web standardized text into an attack identification task template included in the multi-task prompt response template library to obtain Web standardized prompt word information; inputting the Web standardized prompt word information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, and sending the vulnerability attack type information to an alarm terminal for alarm processing. The implementation improves the identification effect of Web vulnerability attack behavior in real-world scenarios.

Description

Technical Field

[0001] The embodiments of this application relate to the field of network security protocol vulnerability attack identification, specifically to methods, apparatus, devices, and media for identifying Web vulnerability attack types based on large language models. Background Technology

[0002] With the increasing complexity of cyber threats, the types and methods of Web vulnerability attacks continue to evolve. Accurately identifying Web vulnerability attack types has become a crucial task in cybersecurity. Different types of attacks typically correspond to different attack vectors and semantic features. For example, SQL (Structured Query Language) injection attacks primarily target database query statements, XSS (Cross-Site Scripting) attacks focus on injecting scripts into web pages, path traversal attacks often utilize file paths to construct illegal requests, and Remote Code Execution (RCE) attacks attempt to execute attack code on the server side. In recent years, research on Web vulnerability attack type identification has deepened. Early research mainly relied on regularization matching methods for rule identification. With the continuous development of artificial intelligence technology, research focus has gradually shifted to machine learning and deep learning, improving identification effectiveness by optimizing feature selection methods. However, these methods still suffer from low identification efficiency and insufficient adaptability when facing unknown threats, making them difficult to cope with complex and ever-changing network environments. Compared with traditional methods, the rapid development of Large Language Models (LLMs) provides new research ideas for solving the problem of Web vulnerability attack identification.

[0003] Despite the progress made in this field, many challenges remain in the current complex environment:

[0004] (1) The limited number of instances leads to insufficient understanding of the underlying features of the attack samples by the model;

[0005] (2) The ability to identify unknown and complex attacks cannot meet the task requirements in increasingly complex network environments;

[0006] (3) When the parameter size is small, the illusion problem is likely to occur. When LLM performs the task of identifying Web vulnerability attack types, due to the lack of in-depth cybersecurity domain knowledge in the pre-training data, it may generate results that are weakly correlated or even completely unrelated to the Web vulnerability attack type when faced with such complex tasks, thus affecting the accuracy and reliability of the identification. Summary of the Invention

[0007] The summary section of this application is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0008] Some embodiments of this application propose a method, apparatus, computer device, and computer-readable storage medium for identifying Web vulnerability attack types based on a large language model, in order to solve one or more of the technical problems mentioned in the background section above.

[0009] In a first aspect, some embodiments of this application provide a method for identifying Web vulnerability attack types based on a large language model. The method includes: inputting pre-acquired Web vulnerability attack data into a behavior-accurate identification task template included in a multi-task prompt response template library to obtain behavior-accurate identification task information, wherein the multi-task prompt response template library further includes an attack identification task template; performing greedy sampling inference processing on the behavior-accurate identification task information to obtain at least one inference result; in response to determining that each inference result in the at least one inference result satisfies a preset reasoning condition, performing normalization processing on the Web vulnerability attack data based on the multi-task prompt response template library to obtain Web specification text; inputting the Web specification text into the attack identification task template included in the multi-task prompt response template library to obtain Web specification prompt word information; inputting the Web specification prompt word information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information; and sending the vulnerability attack type information to an alarm terminal for alarm processing.

[0010] Secondly, some embodiments of this disclosure provide a Web vulnerability attack type identification device based on a large language model. The device includes: a first input unit configured to input pre-acquired Web vulnerability attack data into a behavior-accurate identification task template included in a multi-task prompt response template library to obtain behavior-accurate identification task information, wherein the multi-task prompt response template library further includes an attack identification task template; a greedy sampling inference unit configured to perform greedy sampling inference processing on the behavior-accurate identification task information to obtain at least one inference result; a normalization unit configured to, in response to determining that each inference result in the at least one inference result satisfies a preset reasoning condition, perform normalization processing on the Web vulnerability attack data based on the multi-task prompt response template library to obtain Web standard text; a second input unit configured to input the Web standard text into the attack identification task template included in the multi-task prompt response template library to obtain Web standard prompt word information; and a third input unit configured to input the Web standard prompt word information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, and send the vulnerability attack type information to an alarm terminal for alarm processing.

[0011] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0012] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0013] The above embodiments of this application have the following beneficial effects: Through the Web vulnerability attack type identification method based on a large language model according to some embodiments of this application, during the training process, the collected tagged data packets are input into the data preprocessing part to extract the core content of HTTP (Hypertext Transfer Protocol), and prompts are generated based on the constructed two categories of prompt response templates: attack identification and data processing. Subsequently, the pre-trained model ChatGLM (Generative Language Model) and the generated prompt are input into the fine-tuning part to reinitialize the linear transformation weight matrix in the ChatGLM model, forming a model with a bypass structure. Next, the instructions, inputs, and questions in the prompt are input into the model to obtain the predicted response. By comparing the standard response and the predicted response in the prompt, while freezing the new linear transformation weight matrix, the loss is calculated and the gradient is updated, completing the parameter update of the bypass structure. Finally, the parameters of the new linear transformation weight matrix are adjusted according to the gradient update mechanism to obtain the fine-tuned WebLLM model. During inference, the collected data packets are directly input into the data preprocessing module. Following the same processing flow as the training phase, a prompt without a standard response is generated. This prompt is then input into the agent inference module, first processed by the greedy sampling inference module. If the greedy sampling inference fails, the inference task is transferred to the thought chain inference module. This hierarchical inference mechanism more effectively completes the identification task. Therefore, a method for identifying Web vulnerability attacks in large-scale, unbalanced network traffic environments is proposed, aiming to improve the model's ability to identify Web vulnerability attacks in real-world scenarios. This method focuses on key information and incorporates expert knowledge. By using a relatively unified mapping representation of URL (Uniform Resource Locator) requests, it effectively reduces the interference of redundant information on recognition performance, thereby strengthening the model's ability to learn important features. Simultaneously, this application performs multi-level feature extraction on the input text at three granularities: word level, sentence level, and context level. An adaptive weighted feature fusion strategy is used to achieve complementary enhancement of information at different semantic levels, ultimately completing the classification decision. Therefore, this application demonstrates superior recognition performance compared to existing methods under conditions of large-scale unbalanced sample distribution, while reducing the false alarm rate, and can better adapt to the needs of identifying Web vulnerability attack behavior in real complex network environments. Attached Figure Description

[0014] The above and other features, advantages, and aspects of the embodiments of this application will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0015] Figure 1 This is a flowchart of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application;

[0016] Figure 2 This is a schematic diagram of a multi-task prompt response template library based on some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application;

[0017] Figure 3 This is a schematic diagram of the weight matrix structure of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application;

[0018] Figure 4 This is a schematic diagram of the architecture of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application;

[0019] Figure 5 This is a schematic diagram of the structure of some embodiments of the Web vulnerability attack type identification method and apparatus based on a large language model according to the present disclosure;

[0020] Figure 6 This is a schematic diagram of the structure of a computer device suitable for implementing some embodiments of this application. Detailed Implementation

[0021] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While some embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this application. It should be understood that the drawings and embodiments of this application are for illustrative purposes only and are not intended to limit the scope of protection of this application.

[0022] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0023] It should be noted that the concepts of "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0024] It should be noted that the terms "a" and "a plurality of" used in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0025] The names of the messages or information exchanged between multiple devices in the embodiments of this application are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0026] The present application will now be described in detail with reference to the accompanying drawings and embodiments.

[0027] Figure 1 A flow 100 of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application is shown. The Web vulnerability attack type identification method based on a large language model includes the following steps:

[0028] Step 101: Input the pre-acquired Web vulnerability attack data into the behavior precision recognition task template included in the multi-task prompt response template library to obtain behavior precision recognition task information.

[0029] In some embodiments, the execution entity of the Web vulnerability attack type identification method based on a large language model can input pre-acquired Web vulnerability attack data into the behavior precision identification task template included in the multi-task prompt response template library to obtain behavior precision identification task information. The multi-task prompt response template library further includes: attack identification task template, data decoding task template, and normalization processing task template. Web vulnerability attack data can be obtained through computer network packet capture. The Web vulnerability attack data can include: Web address data and Web request body data. The Web address data can represent the URL information of the Web vulnerability attack data. The Web request body data can represent the body (request body) information of the Web vulnerability attack data.

[0030] Specifically, in network requests, the URL serves as a key data carrier of attack information. Its special characters, parameter structure, and other related features are crucial for identifying Web vulnerability attack types, and numerous studies use the URL as input information for Web vulnerability attack identification. Furthermore, the request body of an HTTP request contains the main content of the request; attackers may carefully design it to include malicious code or data, thereby achieving a Web attack. Therefore, some studies, while selecting the URL as part of the information, add request body information as auxiliary input. Through comprehensive analysis, they can more accurately capture the characteristics of attack types and improve the accuracy of Web vulnerability attack type identification. In natural language processing, input sequences are often truncated and padded with zeros to adapt to model design and batch processing, which may lead to information loss and redundancy, affecting model performance. In the task of Web vulnerability attack type identification, complete input of the URL and request body information is crucial; truncating and padding may lead to the loss of key features, affecting the model's accurate identification of attack types. This application can fully utilize the advantages of LLM in handling long context content and flexible input, analyze collected data packets, identify and filter protocols, parse HTTP requests, and extract the URL and request body to comprehensively capture attack information.

[0031] The aforementioned multi-task prompt response template library can be a pre-generated instruction template library that takes Web vulnerability attack data as input and outputs template task information. Specifically, the behavior precision recognition task template can be an instruction template that takes Web vulnerability attack data as input and outputs behavior precision recognition task information. The attack recognition task template can be an instruction template that takes Web specification text as input and outputs Web specification prompt word information. The data decoding task template can be an instruction template that takes Web vulnerability attack data as input and outputs Web decoded data. The normalization processing task template can be an instruction template that takes Web decoded text as input and outputs Web specification data.

[0032] As an example, the above multi-task prompt response template library can be referenced. Figure 2 The diagram illustrates a multi-task prompt response template library based on some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application. Figure 2 As shown, the attack identification task templates included in the aforementioned multi-task prompt response template library can be... Figure 2 (a) or (b) in the example.

[0033] Figure 2 In this context, (a) can represent the template for an abnormal behavior recognition task. It can represent the Web specification prompt information output by the abnormal behavior recognition task template. This can represent the aforementioned web vulnerability attack data. This can indicate whether the above Web vulnerability attack data is related to the attack type ("not white" indicates related, "white" indicates unrelated). This can be represented within this template. The corresponding tags.

[0034] Figure 2 (b) in the text can represent a specific attack identification task template. It can represent the Web specification prompt information output by the specific attack identification task template. This can represent the aforementioned web vulnerability attack data. Indicates that it can be selected as Any one of them (including) , , , ). This can indicate whether the aforementioned web vulnerability attack data is related to... Attack type related ("not white" means related, "white" means unrelated). This can be represented within this template. The corresponding tags. This can refer to SQLI (SQL Injection) attacks. This can represent an XSS attack. This can represent a path attack. This can refer to an RCE (Remote Code Execution) attack.

[0035] Figure 2 In the above, (c) to (f) can represent one of the above-mentioned behavior accurate recognition task templates. This can represent the first attack identification task information, which includes the task information for accurately identifying behaviors. This can represent the second attack identification task information, which includes the task information for accurately identifying behaviors. This can represent the third attack identification task information, which includes the task information for accurately identifying behaviors. This can represent the fourth attack identification task information, which includes the task information for accurately identifying behaviors. This indicates that the input text can be one of three types (including Web vulnerability attack data, Web address data, and Web request body data). It can represent the precise behaviors identified (including) , , , , ). This can be represented within this template. The corresponding tags.

[0036] Figure 2 In this context, (g) can represent a data decoding task template. It can represent Web decoded data. This can represent the aforementioned web vulnerability attack data. It can represent the result obtained after decoding web vulnerability attack data.

[0037] Figure 2 In this context, (h) can represent a normalization processing task template. It can represent Web specification data. It can represent Web decoded data. It can represent Web specification data obtained after normalizing Web decoded data.

[0038] Specifically, in the behavior precision recognition task template middle: , It provides detailed instructions and problem descriptions, and assigns specific identity information to the LLM, aiming to more effectively mobilize the relevant knowledge of Web vulnerability attack type identification tasks learned in the pre-training stage and achieve better interactive effects. It adopts a simple input method, aiming to guide LLMs to focus more on the input text itself. A template for the same task is constructed, but the prompt generated by this template is not used in the fine-tuning task. The purpose is to provide a control template for subsequent prompt impact verification experiments, so as to evaluate the specific impact of using different prompt templates to generate responses in the inference and fine-tuning phases on the experimental results.

[0039] In some embodiments, the LLM illusion problem refers to the possibility that LLM models may generate seemingly reasonable but unrealistic content when generating content based on input. Furthermore, the lack of cybersecurity knowledge in LLM models can sometimes affect the accuracy of their answers to security-related questions. To alleviate the LLM illusion problem and more effectively learn the underlying features of input information, step 101 above designs a set of prompt response templates for Web vulnerability attack identification tasks. This template library aims to supplement the lack of cybersecurity expertise in LLM models and standardize the format of prompts and responses during fine-tuning. The template library is divided into two main categories of prompt response templates: attack identification and data processing (attack identification task templates and behavior precision identification task templates). Template design and input / output content construction are performed for initial annotated instances. In the attack identification prompt response templates, three specific task templates are set up: abnormal behavior identification, specific attack identification, and behavior precision identification. Accurate identification of Web vulnerability attack types is achieved through feature sharing in multi-task learning. In the data processing templates, two types of templates are designed: data decoding and normalization processing, aiming to provide support and assistance for subsequent thought chain reasoning tasks.

[0040] In the prompt response template, the instructions and questions are natural language sequences describing the task, the input is supplementary contextual information about the task described by the instructions, and the output is the correct answer that the LLM expects to provide. When designing the prompt response template, step 101 above can accurately describe the task by carefully constructing the instructions and questions, ensuring that the natural language sequence clearly conveys the task requirements. To improve template performance, several key elements are introduced. By setting a specific identity, such as a cybersecurity expert, the relevance and professionalism of the task are enhanced. Simultaneously, to address the issue of overly lengthy LLM responses containing irrelevant content, the keyword "output only" is added to the prompt to limit the LLM's over-extension and ensure the conciseness and relevance of the response. Furthermore, relevant background information is provided, such as URL information and request body information, to help the LLM better understand the context. Thus, after verification, these settings effectively guide the LLM to avoid outputting irrelevant content, reduce redundant information, and effectively solve the problem of garbled output.

[0041] Step 102: Perform greedy sampling and reasoning processing on the behavior accuracy recognition task information to obtain at least one reasoning result.

[0042] In some embodiments, the aforementioned executing entity may perform greedy sampling and inference processing on the aforementioned behavior accuracy identification task information to obtain at least one inference result. Specifically, performing greedy sampling and inference processing on the aforementioned behavior accuracy identification task information to obtain at least one inference result may involve using a greedy sampling algorithm to sample each attack identification task information within at least one attack identification task information included in the aforementioned behavior accuracy identification task information to obtain at least one inference result.

[0043] Step 103: In response to determining that each reasoning result in at least one reasoning result satisfies the preset reasoning conditions, the Web vulnerability attack data is normalized based on the multi-task prompt response template library to obtain Web specification text.

[0044] In some embodiments, the executing entity may, in response to determining that each of the at least one inference result satisfies a preset reasoning condition, perform normalization processing on the Web vulnerability attack data based on the multi-task prompt response template library to obtain Web specification text. The preset reasoning condition may be that each of the at least one inference result is different.

[0045] In some optional implementations of certain embodiments, the execution entity, based on the aforementioned multi-task prompt response template library, performs normalization processing on the aforementioned Web vulnerability attack data to obtain Web specification text, which may include the following steps:

[0046] The first step is to input the aforementioned Web vulnerability attack data into the data decoding task template included in the aforementioned multi-task prompt response template library to obtain Web decoding data.

[0047] The second step involves inputting the aforementioned Web decoded data into the Web vulnerability attack type identification model to obtain the Web decoded text. The Web vulnerability attack type identification model can be a pre-trained LLM (Large Language Model).

[0048] The third step is to input the above-mentioned Web decoded text into the normalization processing task template included in the above-mentioned multi-task prompt response template library to obtain Web specification data.

[0049] The fourth step is to input the above Web specification data into the Web vulnerability attack type identification model to obtain the Web specification text.

[0050] Optionally, the aforementioned executing entity may also, in response to determining that each of the at least one reasoning result does not satisfy the preset reasoning conditions, randomly select one of the at least one reasoning results as vulnerability attack type information.

[0051] Step 104: Input the Web specification text into the attack identification task template included in the multi-task prompt response template library to obtain Web specification prompt information.

[0052] In some embodiments, the aforementioned execution entity may input the aforementioned Web specification text into the attack identification task template included in the aforementioned multi-task prompt response template library to obtain Web specification prompt word information.

[0053] In some embodiments, LLMs exhibit superior output and processing capabilities when handling simple or well-defined problems. However, their capabilities are often limited when faced with highly complex tasks. Therefore, this section considers designing an agent-guided inference process to decompose complex tasks into several sub-tasks suitable for LLM processing, thereby compensating for the shortcomings of LLMs in complex scenarios and better meeting practical application needs.

[0054] Optionally, before inputting the aforementioned Web specification prompt information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, the aforementioned execution entity may also perform the following steps.

[0055] The first step is to obtain the web training dataset and the web attack label set. The web training data in the web training dataset corresponds one-to-one with the web attack labels in the web attack label set. These datasets can be obtained from a general intrusion detection database via wired or wireless connections.

[0056] As an example, the aforementioned general intrusion detection database may be, but is not limited to, at least one of the following: IDS2025 (Intrusion Detection System 2025) database, Biblio-US17 (Biblio-University of Seville 2017, a dataset of real network logs from university libraries) database, or GeNIS (GECAD Network Intrusion Scenarios, a dataset of computer-aided design network intrusion scenarios).

[0057] The second step is to select target Web training data from the Web training dataset and perform the following training sub-steps:

[0058] The first sub-step involves inputting the target Web training data into the multi-task prompt response template library to obtain initial Web specification prompt word information. Specifically, Web training data can be randomly selected from the aforementioned Web training dataset as the target Web training data. For details on the specific implementation of generating the initial Web specification prompt word information and its resulting technical effects, please refer to steps 101-103 in the above embodiments, which will not be repeated here.

[0059] The second sub-step involves inputting the initial Web specification prompt information into the initial Web vulnerability attack type identification model to obtain initial Web vulnerability attack type information. This initial Web vulnerability attack type identification model can be an untrained large language model that takes specification prompt information as input and vulnerability attack type information as output. This initial Web vulnerability attack type identification model may include an initial linear transformation matrix. This initial linear transformation matrix can be the parameter matrix of the initial Web vulnerability attack type identification model.

[0060] As an example, the initial Web vulnerability attack type identification model mentioned above could be the ChatGLM model.

[0061] The third sub-step involves determining the identification loss value of the Web attack labels and initial Web vulnerability attack type information corresponding to the target Web training data in the Web attack label set, based on a preset loss function.

[0062] As an example, the preset loss function mentioned above can be, but is not limited to, one of the following: cross-entropy loss function, least squares function, or classification cross-entropy loss function.

[0063] The fourth sub-step involves adjusting the initial Web vulnerability attack type identification model based on the identification loss value, resulting in an adjusted Web vulnerability attack type identification model.

[0064] The fifth sub-step involves deleting the target Web training data from the Web training dataset, resulting in the deleted Web training dataset.

[0065] The sixth sub-step, in response to determining that the deleted Web training dataset meets the preset training conditions, identifies the adjusted Web vulnerability attack type identification model as the Web vulnerability attack type identification model. The preset training conditions can include the deleted Web training dataset being empty.

[0066] Optionally, the aforementioned executing entity may also, in response to determining that the deleted Web training dataset does not meet the preset training conditions, determine the adjusted Web vulnerability attack type identification model as the initial Web vulnerability attack type identification model, and select target Web training data from the deleted Web training dataset for re-executing the aforementioned training steps. Specifically, Web training data can be randomly selected from the deleted Web training dataset as the target Web training data.

[0067] In some optional implementations of certain embodiments, the execution entity adjusts the initial Web vulnerability attack type identification model based on the identification loss value to obtain an adjusted Web vulnerability attack type identification model, which may include the following steps:

[0068] The first step involves decomposing the initial linear transformation matrix included in the initial Web vulnerability attack type identification model to obtain a first initial orthogonal matrix, a second initial orthogonal matrix, and an initial diagonal matrix. This decomposition can be performed using a pre-defined matrix factorization algorithm.

[0069] As an example, the aforementioned preset matrix factorization algorithm can be the SVD (Singular Value Decomposition) algorithm.

[0070] The second step involves dimensionality reduction of the first initial orthogonal matrix, the second initial orthogonal matrix, and the initial diagonal matrix to obtain a low-rank approximate matrix. This low-rank approximate matrix can be obtained by using the aforementioned preset matrix decomposition algorithm.

[0071] The third step involves constructing a first low-rank matrix and a second low-rank matrix based on the first initial orthogonal matrix, the second initial orthogonal matrix, and the initial diagonal matrix. Specifically, based on the low-rank approximation matrix, the first and second low-rank matrices can be constructed using the following formula:

[0072]

[0073] .

[0074] in, It can represent the first low-rank matrix. It can represent the first initial orthogonal matrix. It can represent an initial diagonal matrix. It can represent the second low-rank matrix. It can represent the second initial orthogonal matrix. It can represent the dimension value after dimensionality reduction, which is set in advance.

[0075] As an example, the dimension values ​​mentioned above can be, but are not limited to, 3, 4, or 5.

[0076] The fourth step is to determine the residual matrix by the difference between the initial linear transformation matrix and the low-rank approximation matrix. Therefore, the linear transformation matrix can be updated into the residual matrix. This makes the overall weight matrix more stable after the introduction of the bypass structure. Maintain the original weights This ensures that the introduction of a low-rank matrix does not affect the model's own weights at the beginning of training.

[0077] The fifth step involves updating the residual matrix based on the recognition loss value, the first low-rank matrix, and the second low-rank matrix, to obtain the updated residual matrix. Specifically, based on the recognition loss value, the first low-rank matrix, and the second low-rank matrix, firstly, a model training optimizer can be generated using a pre-defined model optimization algorithm and the recognition loss value. Then, the residual matrix can be updated using the following formula to obtain the updated residual matrix:

[0078] .

[0079] in, It can indicate the current training round. , They can represent the first one respectively. The first low-rank matrix before passing through the model training optimizer. Second low-rank matrix . , These can be represented as the first low-rank matrix after being updated by the optimizer. Second low-rank matrix . It can represent the first low-rank matrix Second low-rank matrix The change in the product of . , They can represent the first one respectively. The residual matrix before the next update and the The residual matrix after the second update . It can be used to express Incremental update The parameter update ratio. It can represent a scaling factor.

[0080] As an example, the above-mentioned preset model optimization algorithm may be, but is not limited to, at least one of the following: SGD (Stochastic Gradient Descent) algorithm, Adam optimization algorithm, or NAG (Nesterov Accelerated Gradient) algorithm.

[0081] It is important to note that during the update process, special attention should be paid to the base number of the Web vulnerability attack type identification model, ensuring that the weights of each layer with a self-attention structure are updated separately with each update.

[0082] Therefore, the model's ability to analyze Web vulnerability attack types can be enhanced without significantly increasing computational costs, by considering the linear transformation matrix that should remain unchanged during training. Parameters are updated to improve the fine-tuning effect of the model.

[0083] The sixth step is to determine the updated linear transformation matrix by summing the updated residual matrix and the low-rank approximation matrix.

[0084] Step 7: The updated linear transformation matrix is ​​determined to be the linear transformation matrix included in the adjusted Web vulnerability attack type identification model.

[0085] In some embodiments, the above-described adjustment process for the initial Web vulnerability attack type identification model can refer to Figure 3 The diagram illustrates the weight matrix structure of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application. Figure 3 As shown, Current Pretrained Weights can represent the current pretrained weights.

[0086] In some embodiments, the core objective of fine-tuning is to improve the performance and accuracy of the model in a specific task with lower computational cost, avoiding the resource consumption associated with a comprehensive update of the entire pre-trained weight matrix. Traditional fine-tuning methods typically require adjusting all parameters of the model, resulting in significant computational and storage overhead. In recent years, structured fine-tuning methods have gradually become mainstream, among which LoRA (Low-Rank Adaptation) is more suitable for tasks such as Web vulnerability attack type identification due to its efficiency and flexibility. This is achieved by introducing a trainable low-rank bypass matrix (denoted as ) into the existing model structure. and This method freezes the weights of the original linear transformation layer during fine-tuning, updating only the newly added low-rank parameters, thus significantly reducing training costs. Furthermore, this method supports customized bypass structures for different tasks, thereby enhancing the model's task adaptability. The weight matrix structure corresponding to LoRA fine-tuning can be found in [reference needed]. Figure 3 The diagram shows a weight matrix structure of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application. However, LoRA fine-tuning still has limitations. To solve its problems of initialization sensitivity and limited task adaptability, this application proposes a fine-tuning method as described in step 104.

[0087] Therefore, compared to LoRA fine-tuning, step 104 uses the principal singular values ​​and singular value vectors of the original linear transformation matrix when initializing the low-rank matrix, instead of initializing the low-rank matrix as Gaussian and zero. This allows for updating the main part of the weights early in training, effectively avoiding the significant resource waste during gradient descent caused by the slow update of the main part of the initial linear transformation matrix in the early stages of LoRA fine-tuning. Simultaneously, based on the matrix... Same weight matrix The gradient relationship is used to calculate the increment of the low-rank matrix product between consecutive training steps. The model is updated as many times as possible without significantly increasing overhead, making it better suited for web vulnerability attack tasks and effectively alleviating the illusion problem of LLM.

[0088] Step 105: Input the Web specification prompt information into the pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, and send the vulnerability attack type information to the alarm terminal for alarm processing.

[0089] In some embodiments, the execution entity may input the aforementioned Web specification prompt information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, and then send the vulnerability attack type information to an alarm terminal for alarm processing. Here, the alarm terminal may be a terminal that displays warning text or emits a prompt sound in response to receiving the aforementioned vulnerability attack type information.

[0090] In some optional implementations of certain embodiments, the execution entity inputs the aforementioned Web specification prompt information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, which may include the following steps:

[0091] The first step involves inputting the aforementioned Web specification prompts into a pre-trained Web vulnerability attack type identification model to obtain first vulnerability attack type information. This first vulnerability attack type information can include information representing "related to the attack type" and information representing the attack type itself. Alternatively, it can consist of information representing "unrelated to the attack type." The pre-trained Web vulnerability attack type identification model can be a pre-trained large language model that takes specification prompts as input and vulnerability attack type information as output.

[0092] As an example, the attack type information mentioned above can be, but is not limited to, at least one of the following: SQLI attack, XSS attack, path attack, or RCE attack. Information indicating "related to attack type" can be "not white". Information indicating "unrelated to attack type" can be "white".

[0093] The second step involves determining that the first vulnerability attack type information satisfies a first preset output condition, and then classifying the first vulnerability attack type information as vulnerability attack type information. The first preset output condition may include information representing "related to the attack type" within the first vulnerability attack type information.

[0094] Optionally, the aforementioned implementing entity may also perform the following steps:

[0095] The first step, in response to the determination that the first vulnerability attack type information does not meet the first preset output condition, is to standardize the Web address data included in the Web vulnerability attack data based on the multi-task prompt response template library, thereby obtaining standardized Web address text. The specific implementation method for generating the standardized Web address text and its resulting technical effects can be found in step 103 of the above embodiments, and will not be repeated here.

[0096] The second step is to input the above Web address specification text into the attack identification task template included in the above multi-task prompt response template library to obtain Web address specification prompt information.

[0097] The third step involves inputting the aforementioned Web address specification prompts into a pre-trained Web vulnerability attack type identification model to obtain the second vulnerability attack type information. This second vulnerability attack type information can include information representing "related to the attack type" and information representing the attack type itself. Alternatively, it can consist of information representing "unrelated to the attack type."

[0098] Fourth step: In response to determining that the above-mentioned second vulnerability attack type information meets the second preset output condition, the above-mentioned second vulnerability attack type information is determined as vulnerability attack type information. The second preset output condition may include information representing "related to the attack type" in the above-mentioned second vulnerability attack type information.

[0099] Optionally, the aforementioned implementing entity may also perform the following steps:

[0100] The first step, in response to the determination that the second vulnerability attack type information does not meet the second preset output condition, is to standardize the Web request body data included in the Web vulnerability attack data based on the multi-task prompt response template library, thereby obtaining the Web request body standardized text. The specific implementation method for generating the Web request body standardized text and its resulting technical effects can be found in step 103 of the above embodiments, and will not be repeated here.

[0101] The second step is to input the above Web request body specification text into the attack identification task template included in the above multi-task prompt response template library to obtain the Web request body specification prompt information.

[0102] The third step involves inputting the aforementioned Web request body specification prompts into a pre-trained Web vulnerability attack type identification model to obtain third vulnerability attack type information. This third vulnerability attack type information can include information representing "attack type relatedness" and attack type information. Alternatively, it can consist of information representing "unrelated to attack type."

[0103] The fourth step is to determine the aforementioned third vulnerability attack type information as vulnerability attack type information.

[0104] Therefore, steps 102-105 treat the identification problem as a multi-classification task. During the inference phase, the fine-tuned model is required to use the same prompt template as in the fine-tuning phase to generate the response for each test sample. Three modules are considered for the agent-guided inference task: a control module, a greedy sampling inference module, and a thought chain inference module. The control module determines the output and allocates data to specific inference modules. The greedy sampling inference module employs a greedy decoding strategy, outputting the category with the highest probability for classification problems. The thought chain inference module is activated when the results of three greedy decoding attempts are inconsistent. It uses the fine-tuned WebLLM to generate decoded and normalized text, interacts with the WebLLM multiple times through prompts corresponding to different tasks, and finally outputs the best label result.

[0105] The above embodiments of this application have the following beneficial effects: Through the Web vulnerability attack type identification method based on a large language model according to some embodiments of this application, during the training process, the collected tagged data packets are input into the data preprocessing part to extract the core content of HTTP (Hypertext Transfer Protocol), and prompts are generated based on the constructed two categories of prompt response templates: attack identification and data processing. Subsequently, the pre-trained model ChatGLM (Generative Language Model) and the generated prompt are input into the fine-tuning part to reinitialize the linear transformation weight matrix in the ChatGLM model, forming a model with a bypass structure. Next, the instructions, inputs, and questions in the prompt are input into the model to obtain the predicted response. By comparing the standard response and the predicted response in the prompt, while freezing the new linear transformation weight matrix, the loss is calculated and the gradient is updated, completing the parameter update of the bypass structure. Finally, the parameters of the new linear transformation weight matrix are adjusted according to the gradient update mechanism to obtain the fine-tuned WebLLM model. During inference, the collected data packets are directly input into the data preprocessing module. Following the same processing flow as the training phase, a prompt without a standard response is generated. This prompt is then input into the agent inference module, first processed by the greedy sampling inference module. If the greedy sampling inference fails, the inference task is transferred to the thought chain inference module. This hierarchical inference mechanism more effectively completes the identification task. Therefore, a method for identifying Web vulnerability attacks in large-scale, unbalanced network traffic environments is proposed, aiming to improve the model's ability to identify Web vulnerability attacks in real-world scenarios. This method focuses on key information and incorporates expert knowledge. By using a relatively unified mapping representation of URL (Uniform Resource Locator) requests, it effectively reduces the interference of redundant information on recognition performance, thereby strengthening the model's ability to learn important features. Simultaneously, this application performs multi-level feature extraction on the input text at three granularities: word level, sentence level, and context level. An adaptive weighted feature fusion strategy is used to achieve complementary enhancement of information at different semantic levels, ultimately completing the classification decision. Therefore, this application demonstrates superior recognition performance compared to existing methods under conditions of large-scale unbalanced sample distribution, while reducing the false alarm rate, and can better adapt to the needs of identifying Web vulnerability attack behavior in real complex network environments.

[0106] Further reference Figure 4 , Figure 4 The diagram illustrates the architecture of some embodiments of the Web vulnerability attack type identification method based on a large language model according to this application. Figure 4 As shown, pcap can represent a network packet file. Tagged pcap files can be web training datasets or web attack tag sets. Untagged pcap files can be web vulnerability attack data. , , ,and These can be represented as the weight matrices in the initial Web vulnerability attack type identification model. Self-attention can represent a self-attention network layer. Forward Network can represent a forward network layer. deltaAB can represent... SGL can represent XX. WebLLM can represent a Web vulnerability attack type identification model.

[0107] Further reference Figure 5 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of a Web vulnerability attack type identification device based on a large language model. These device embodiments are similar to... Figure 1 Corresponding to the method embodiments shown, this Web vulnerability attack type identification device based on a large language model can be specifically applied to various electronic devices.

[0108] like Figure 5 As shown, the web page generation apparatus 500 in some embodiments includes: a first input unit 501, a greedy sampling inference unit 502, a normalization unit 503, a second input unit 504, and a third input unit 505. The system includes the following components: a first input unit 501, configured to input pre-acquired Web vulnerability attack data into a behavior-accurate identification task template included in a multi-task prompt response template library to obtain behavior-accurate identification task information; a greedy sampling inference unit 502, configured to perform greedy sampling inference processing on the behavior-accurate identification task information to obtain at least one inference result; a normalization unit 503, configured to, in response to determining that each inference result in the at least one inference result satisfies a preset reasoning condition, perform normalization processing on the Web vulnerability attack data based on the multi-task prompt response template library to obtain Web specification text; a second input unit 504, configured to input the Web specification text into the attack identification task template included in the multi-task prompt response template library to obtain Web specification prompt word information; and a third input unit 505, configured to input the Web specification prompt word information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information and send the vulnerability attack type information to an alarm terminal for alarm processing.

[0109] It is understandable that the units described in the Web vulnerability attack type identification device 500 based on the large language model are similar to those in the reference device. Figure 1 The steps described in the method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the Web vulnerability attack type identification device 500 based on a large language model and the units contained therein, and will not be repeated here.

[0110] This application also provides a computer device 600. For example... Figure 6 As shown, computer device 600 includes: bus 601, processor 602, memory 603, and communication interface 604. Processor 602, memory 603, and communication interface 604 communicate via bus 601. Computer device 600 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computer device 600.

[0111] Bus 601 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 6 The bus 601 is represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 601 may include a path for transmitting information between various components of the computer device 600 (e.g., memory 603, processor 602, communication interface 604).

[0112] Processor 602 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0113] Memory 603 may include volatile memory, such as random access memory (RAM). Memory 603 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0114] The memory 603 stores executable program code, which the processor 602 executes to implement the functions of the aforementioned first input unit, greedy sampling inference unit, normalization unit, second input unit, and third input unit, thereby realizing the aforementioned Web vulnerability attack type identification method based on a large language model. In other words, the memory 603 stores instructions for executing the aforementioned Web vulnerability attack type identification method based on a large language model.

[0115] The communication interface 604 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computer device 600 and other devices or communication networks.

[0116] This application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in the memory through the data interface to execute the above-described Web vulnerability attack type identification method based on a large language model.

[0117] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the aforementioned Web vulnerability attack type identification method based on a large language model.

[0118] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0119] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying Web vulnerability attack types based on a large language model, comprising: The pre-acquired Web vulnerability attack data is input into the behavior precision identification task template included in the multi-task prompt response template library to obtain behavior precision identification task information. The multi-task prompt response template library also includes: attack identification task template. Greedy sampling and inference processing is performed on the behavior accurate identification task information to obtain at least one inference result; In response to determining that each of the at least one reasoning results satisfies a preset reasoning condition, the Web vulnerability attack data is normalized based on the multi-task prompt response template library to obtain Web standard text. The Web specification text is input into the attack identification task template included in the multi-task prompt response template library to obtain Web specification prompt word information; The Web specification prompt information is input into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, and the vulnerability attack type information is sent to the alarm terminal for alarm processing.

2. The Web vulnerability attack type identification method based on a large language model according to claim 1, characterized in that, The multi-task prompt response template library further includes: a data decoding task template and a normalization processing task template; and, based on the multi-task prompt response template library, the normalization processing of the Web vulnerability attack data to obtain Web standard text includes: The Web vulnerability attack data is input into the data decoding task template included in the multi-task prompt response template library to obtain Web decoded data; The Web decoded data is input into the Web vulnerability attack type identification model to obtain the Web decoded text; The Web decoded text is input into the normalized processing task template included in the multi-task prompt response template library to obtain Web specification data; The Web specification data is input into the Web vulnerability attack type identification model to obtain the Web specification text.

3. The Web vulnerability attack type identification method based on a large language model according to claim 1, characterized in that, The step of inputting the Web specification prompt information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information includes: The Web specification prompt information is input into a pre-trained Web vulnerability attack type identification model to obtain the first vulnerability attack type information; In response to determining that the first vulnerability attack type information meets the first preset output condition, the first vulnerability attack type information is determined as vulnerability attack type information.

4. The Web vulnerability attack type identification method based on a large language model according to claim 3, characterized in that, The web vulnerability attack data includes: web address data; and the method further includes: In response to determining that the first vulnerability attack type information does not meet the first preset output condition, based on the multi-task prompt response template library, the Web address data included in the Web vulnerability attack data is normalized to obtain Web address normalized text; The Web address specification text is input into the attack identification task template included in the multi-task prompt response template library to obtain Web address specification prompt word information; The Web address specification prompt information is input into a pre-trained Web vulnerability attack type identification model to obtain the second vulnerability attack type information; In response to determining that the second vulnerability attack type information meets the second preset output condition, the second vulnerability attack type information is determined as vulnerability attack type information.

5. The Web vulnerability attack type identification method based on a large language model according to claim 4, characterized in that, The web vulnerability attack data also includes: web request body data; and the method further includes: In response to the determination that the second vulnerability attack type information does not meet the second preset output condition, based on the multi-task prompt response template library, the Web request body data included in the Web vulnerability attack data is normalized to obtain Web request body normalized text; Input the Web request body specification text into the attack identification task template included in the multi-task prompt response template library to obtain Web request body specification prompt information; The Web request body specification prompt information is input into a pre-trained Web vulnerability attack type identification model to obtain third vulnerability attack type information; The third vulnerability attack type information is determined as vulnerability attack type information.

6. The Web vulnerability attack type identification method based on a large language model according to claim 1, characterized in that, Before inputting the Web specification prompt information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, the method further includes: Obtain a Web training dataset and a Web attack label set, wherein the Web training data in the Web training dataset and the Web attack labels in the Web attack label set correspond one-to-one; Select the target web training data from the web training dataset and perform the following training steps: Input the target Web training data into the multi-task prompt response template library to obtain the initial Web specification prompt word information; The initial Web specification prompt information is input into the untrained initial Web vulnerability attack type identification model to obtain the initial Web vulnerability attack type information; Based on a preset loss function, determine the identification loss value of Web attack labels and initial Web vulnerability attack type information corresponding to the target Web training data in the Web attack label set; Based on the identification loss value, the initial Web vulnerability attack type identification model is adjusted to obtain the adjusted Web vulnerability attack type identification model. The target Web training data is removed from the Web training dataset to obtain the Web training dataset after deletion. In response to the determination that the deleted Web training dataset meets the preset training conditions, the adjusted Web vulnerability attack type identification model is determined as the Web vulnerability attack type identification model.

7. The Web vulnerability attack type identification method based on a large language model according to claim 6, characterized in that, The method further includes: In response to the determination that the deleted Web training dataset does not meet the preset training conditions, the adjusted Web vulnerability attack type identification model is determined as the initial Web vulnerability attack type identification model, and target Web training data is selected from the deleted Web training dataset for re-execution of the training steps.

8. The Web vulnerability attack type identification method based on a large language model according to claim 6, characterized in that, The initial Web vulnerability attack type identification model includes: an initial linear transformation matrix; and the adjustment process based on the identification loss value to obtain the adjusted Web vulnerability attack type identification model includes: The initial linear transformation matrix included in the initial Web vulnerability attack type identification model is decomposed to obtain the first initial orthogonal matrix, the second initial orthogonal matrix, and the initial diagonal matrix; The first initial orthogonal matrix, the second initial orthogonal matrix, and the initial diagonal matrix are reduced in dimension to obtain a low-rank approximate matrix. Based on the first initial orthogonal matrix, the second initial orthogonal matrix, and the initial diagonal matrix, construct the first low-rank matrix and the second low-rank matrix; The difference between the initial linear transformation matrix and the low-rank approximation matrix is ​​determined as the residual matrix; Based on the identification loss value, the first low-rank matrix, and the second low-rank matrix, the residual matrix is ​​updated to obtain the updated residual matrix. The sum of the updated residual matrix and the low-rank approximation matrix is ​​used to determine the updated linear transformation matrix; The updated linear transformation matrix is ​​determined to be the linear transformation matrix included in the adjusted Web vulnerability attack type identification model.

9. A Web vulnerability attack type identification device based on a large language model, characterized in that, include: The first input unit is configured to input pre-acquired Web vulnerability attack data into the behavior precision identification task template included in the multi-task prompt response template library to obtain behavior precision identification task information. The multi-task prompt response template library also includes an attack identification task template. A greedy sampling inference unit is configured to perform greedy sampling inference processing on the behavior accurate recognition task information to obtain at least one inference result; The normalization unit is configured to, in response to determining that each of the at least one reasoning results satisfies a preset reasoning condition, perform normalization processing on the Web vulnerability attack data based on the multi-task prompt response template library to obtain Web normalized text; The second input unit is configured to input the Web specification text into the attack identification task template included in the multi-task prompt response template library to obtain Web specification prompt word information; The third input unit is configured to input the Web specification prompt information into a pre-trained Web vulnerability attack type identification model to obtain vulnerability attack type information, and to send the vulnerability attack type information to an alarm terminal for alarm processing.

10. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 8.

11. A computer-readable medium, characterized in that, It stores a computer program, characterized in that the computer program, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images