Malicious traffic identification method and system based on adaptive large model

Abstract

This invention discloses a malicious traffic identification method and system based on an adaptive large model, belonging to the field of web application protection technology in the network security domain. The technical problem it addresses is: how to improve the identification capability of web application firewalls against complex attacks, variant attacks, and unknown attacks, while reducing false positive and false negative rates. The method includes: collecting multimodal data generated by web application access; preprocessing the multimodal data to generate multimodal features; jointly modeling and extracting features from the multimodal features to obtain fused features; inputting the fused features into a large model, and through a progressive process of feature space adaptation, structured prompt guidance, and chained four-dimensional inference, outputting identification results including attack patterns, abnormal behaviors, and confidence levels; identifying malicious traffic and implementing protection based on confidence scores, predetermined risk judgment criteria, and corresponding protection strategies; and adaptively optimizing the large model.

Description

Technical Field

[0001] This invention relates to the field of network security domain web application protection technology, specifically to a method and system for identifying malicious traffic based on an adaptive large model. Background Technology

[0002] With the rapid development of internet applications, web applications have become a crucial platform for business operations for enterprises and individuals, and also a primary target for cyberattacks. Attackers use various methods such as SQL injection, cross-site scripting (XSS) attacks, file upload vulnerabilities, and malicious requests to launch various attacks against web applications, threatening system security and data integrity. To defend against these attacks, web application firewalls (WAFs) are widely deployed for real-time monitoring and filtering of malicious requests.

[0003] Existing WAF technologies primarily rely on rule matching or single-feature models to identify malicious traffic. 1. Rule-based detection methods: These methods rely on manually defined attack features and rule bases, which can effectively identify known attacks. However, when faced with constantly changing or combined evolving attack methods, the cost of updating and maintaining the rules is high, and they cannot respond to unknown attacks in a timely manner. 2. Single-model-based detection methods: Traditional machine learning or single deep learning models can be used to analyze traffic features and detect some abnormal behaviors. However, they usually only focus on single-modal features (such as URL content, request headers or traffic statistics), which makes it difficult to characterize the correlation and contextual dependencies between complex attack behaviors. This results in limited detection capabilities for multi-stage and highly covert attacks.

[0004] Furthermore, contemporary web attacks typically exhibit multimodal feature fusion: request content, behavioral sequences, protocol characteristics, and runtime environment information are all interconnected. Existing methods lack the ability to jointly model and adaptively update multimodal information, making it difficult to accurately identify complex or unknown malicious traffic, thus easily leading to false positives or false negatives.

[0005] Improving the ability of Web Application Firewalls to identify complex, variant, and unknown attacks, and reducing false positive and false negative rates, is a technical problem that needs to be solved. Summary of the Invention

[0006] The technical objective of this invention is to address the above-mentioned shortcomings by providing a malicious traffic identification method and system based on an adaptive large model, in order to solve the technical problem of how to improve the ability of Web application firewalls to identify complex attacks, variant attacks, and unknown attacks, and reduce false positive and false negative rates.

[0007] In a first aspect, the present invention provides a method for identifying malicious traffic based on an adaptive large model, comprising the following steps: Multimodal data acquisition: Collect multimodal data generated by web application access. The multimodal data includes text modal data, statistical modal data, and time-series / graph modal data. Among them, text modal data is the full text information in the HTTP / HTTPS protocol extracted by traffic probe, statistical modal data is the statistical characteristics of the current session, and time-series / graph modal data is the access relationship graph based on IP-URL. Data preprocessing: Data preprocessing is performed on multimodal data. Through data preprocessing, multimodal data is cleaned, parsed, formatted and standardized to generate multimodal features. Multimodal features include text features corresponding to text modal data, statistical features corresponding to statistical modal data, and time series behavioral features corresponding to time series / graph modal data. Multimodal feature modeling: Multimodal features are jointly modeled and extracted. Text features are input into a pre-trained BERT encoder for deep semantic extraction to obtain text feature vectors. Statistical features are input into a multilayer perceptron and mapped to statistical characteristic vectors of the same dimension as the text vectors. Temporal behavioral features are input into an LSTM network to extract temporally dependent feature vectors. Finally, the text feature vectors, statistical feature vectors, and temporal feature vectors are fused through a multi-head cross-attention mechanism to obtain fused features. Inference and analysis: The fused features are input into a large model, and the large model performs a progressive process of feature space adaptation, structured prompt guidance, and chain-like four-dimensional inference. The output includes the identification results of attack patterns, abnormal behaviors, and confidence scores. Based on the confidence scores, as well as the predetermined risk discrimination criteria and corresponding protection strategies, malicious traffic is identified and protection is implemented. Adaptive optimization: Based on historical security data, recognition results, and online detection feedback, the large model is adaptively optimized.

[0008] Preferably, the text modal data includes URI path, query parameters, request body (including JSON / XML / Form-data), user-Agent string, cookie, and custom header, wherein the request body includes JSON, XML, and form-data; Statistical modal data includes request packet size, response packet size, request interval, request frequency per unit time, and status code distribution; When collecting time-series / graph modal data, record access trajectories based on Session ID or IP address to form API call sequences and construct an access relationship graph based on IP-URL.

[0009] As a preferred approach, when preprocessing multimodal data, textual modal data is cleaned and standardized, statistical modal data is standardized using Z-Score or Min-Max normalization, and time series / graph modal data is truncated and padded. A sliding window is set to truncate behavioral sequences that exceed a predetermined length and padding is used to padded behavioral sequences that are insufficient.

[0010] As a preferred approach, when fusing text feature vectors, statistical feature vectors, and temporal feature vectors using a multi-head cross-attention mechanism, the text feature vector is used as the query, and the statistical feature vector and behavioral feature vector are used as the key and value, respectively, to perform cross-modal feature fusion and obtain fused features.

[0011] As a preferred option, the large model includes an embedding layer, a Transformer layer, a pooling layer, and an output layer; The Embedding layer performs unified encoding and fusion of the mapping vector of the fused features and the structured Prompt text of Web traffic analysis, and outputs a fixed-dimensional sequence of fused semantic vectors. The Transformer layer performs multi-head self-attention computation and multi-layer stacked deep feature extraction on the fused semantic vector sequence, mines the correlation between traffic features and completes contextual reasoning, and outputs a high-dimensional deep reasoning feature sequence. The pooling layer performs hybrid pooling on the deep inference feature sequence to achieve feature aggregation and dimensionality reduction, and outputs a global core inference feature vector with fixed dimensions. The output layer classifies, quantifies, and generates inference paths for the global core inference feature vectors, and outputs a standardized inference result set containing classification labels, confidence scores, and chain-like inference paths, which is used for the identification and protection of malicious web traffic. The multi-head self-attention mechanism of the Transformer layer inserts low-rank adapters (LoRA Adapters) into the linear transformation layer. During adaptive optimization, the following operations are included: Obtain a large-scale model for detecting new false positives and false negatives, verified by security experts, and collect complete information on the latest false negative CVE vulnerabilities detected online. Lock the original parameters of the large model, and perform lightweight fine-tuning training on the parameters of LoRA Adapters only for the false positive and false negative sample sets. After verification, load the updated LoRA parameters into the Transformer layer of the online large model. Extract core attack features from the complete information of the latest unreported CVE vulnerabilities, map the core attack features to the embedding space of the large model, transform them into feature vectors of the same dimension as the embedding space, and store the feature vectors in the CVE vulnerability knowledge base; The updated CVE vulnerability knowledge base is linked with the prompt engineering construction phase of the large model. When constructing the structured Prompt, the CVE vulnerability feature vectors in the knowledge base are automatically retrieved and incorporated into it. Continuously monitor the online detection performance of the updated large model, and determine whether to trigger the next round of LoRA parameter updates and CVE vulnerability knowledge base supplementation based on preset evaluation indicators, forming an adaptive optimization closed loop.

[0012] Secondly, the present invention provides a malicious traffic identification system based on an adaptive large model, comprising a multimodal data acquisition module, a data preprocessing module, a multimodal feature modeling module, an inference analysis module, and an adaptive optimization module; The multimodal data acquisition module is used to perform the following: acquire multimodal data generated by Web application access, wherein the multimodal data includes text modal data, statistical modal data and time series / graph modal data, wherein the text modal data is the full text information in the HTTP / HTTPS protocol extracted by traffic probe, the statistical modal data is the statistical characteristics of the current session, and the time series / graph modal data is the access relationship graph based on IP-URL; The data preprocessing module is used to perform the following: data preprocessing on multimodal data, cleaning, parsing, formatting and standardizing multimodal data through data preprocessing, generating multimodal features, including text features corresponding to text modal data, statistical features corresponding to statistical modal data, and time series behavioral features corresponding to time series / graph modal data; The multimodal feature modeling module performs the following operations: jointly modeling and extracting multimodal features; inputting text features into a pre-trained BERT encoder for deep semantic extraction to obtain text feature vectors; inputting statistical features into a multilayer perceptron to map them into statistical characteristic vectors of the same dimension as the text vectors; inputting temporal behavioral features into an LSTM network to extract temporally dependent feature vectors; and fusing text feature vectors, statistical feature vectors, and temporal feature vectors through a multi-head cross-attention mechanism to obtain fused features. The reasoning and analysis module is used to perform the following: inputting fused features into a large model, and through the large model, performing a progressive process of feature space adaptation, structured prompt guidance, and chain-like four-dimensional reasoning, outputting identification results including attack patterns, abnormal behaviors, and confidence scores, and performing malicious traffic identification and protection based on confidence scores, predetermined risk discrimination criteria, and corresponding protection strategies. The adaptive optimization module is used to perform the following: adaptive optimization of the large model based on historical security data, recognition results, and online detection feedback.

[0013] Preferably, the text modal data includes URI path, query parameters, request body (including JSON / XML / Form-data), user-Agent string, cookie, and custom header, wherein the request body includes JSON, XML, and form-data; Statistical modal data includes request packet size, response packet size, request interval, request frequency per unit time, and status code distribution; When collecting time-series / graph modal data, record access trajectories based on Session ID or IP address to form API call sequences and construct an access relationship graph based on IP-URL.

[0014] Preferably, when performing data preprocessing on multimodal data, the data preprocessing module is used to perform text cleaning and standardization on text modal data, Z-Score standardization or Min-Max normalization on statistical modal data, sequence truncation and completion operations on time series / graph modal data, set a sliding window, truncate behavioral sequences that exceed a predetermined length, and padding complete insufficient behavioral sequences.

[0015] Preferably, the multimodal feature modeling module is used to perform cross-modal feature fusion by using the text feature vector, statistical feature vector and temporal feature vector as the query and the statistical feature vector and behavioral feature vector as the key and value when fusing text feature vector, statistical feature vector and behavioral feature vector as the key and value, respectively, to obtain fused features.

[0016] As a preferred option, the large model includes an embedding layer, a Transformer layer, a pooling layer, and an output layer; The Embedding layer performs unified encoding and fusion of the mapping vector of the fused features and the structured Prompt text of Web traffic analysis, and outputs a fixed-dimensional sequence of fused semantic vectors. The Transformer layer performs multi-head self-attention computation and multi-layer stacked deep feature extraction on the fused semantic vector sequence, mines the correlation between traffic features and completes contextual reasoning, and outputs a high-dimensional deep reasoning feature sequence. The pooling layer performs hybrid pooling on the deep inference feature sequence to achieve feature aggregation and dimensionality reduction, and outputs a global core inference feature vector with fixed dimensions. The output layer classifies, quantifies, and generates inference paths for the global core inference feature vectors, and outputs a standardized inference result set containing classification labels, confidence scores, and chain-like inference paths, which is used for the identification and protection of malicious web traffic. In the Transformer layer, low-rank adapters (LoRA Adapters) are inserted into the linear transformation layer using the multi-head self-attention mechanism. The adaptive optimization module is used to perform the following operations: Obtain a large-scale model for detecting new false positives and false negatives, verified by security experts, and collect complete information on the latest false negative CVE vulnerabilities detected online. Lock the original parameters of the large model, and perform lightweight fine-tuning training on the parameters of LoRA Adapters only for the false positive and false negative sample sets. After verification, load the updated LoRA parameters into the Transformer layer of the online large model. Extract core attack features from the complete information of the latest unreported CVE vulnerabilities, map the core attack features to the embedding space of the large model, transform them into feature vectors of the same dimension as the embedding space, and store the feature vectors in the CVE vulnerability knowledge base; The updated CVE vulnerability knowledge base is linked with the prompt engineering construction phase of the large model. When constructing the structured Prompt, the CVE vulnerability feature vectors in the knowledge base are automatically retrieved and incorporated into it. Continuously monitor the online detection performance of the updated large model, and determine whether to trigger the next round of LoRA parameter updates and CVE vulnerability knowledge base supplementation based on preset evaluation indicators, forming an adaptive optimization closed loop.

[0017] The malicious traffic identification method and system based on an adaptive large model of the present invention have the following advantages: 1. Enhance the ability to identify complex attacks: Through multimodal feature fusion, it can comprehensively analyze request content, protocol features, behavior sequences and runtime environment information, fully characterize the multidimensional features of Web attack behavior, and thus effectively identify complex, multi-stage and highly concealed malicious traffic; 2. Enhanced detection capability for unknown attacks: By combining large-scale model semantic understanding and contextual reasoning capabilities, and supplemented by an adaptive optimization mechanism, this invention can discover new attack behaviors that are difficult to detect by traditional rules or single-modal models, thereby improving the accuracy of identifying unknown or variant attacks. 3. Reduce false positives and false negatives: The combination of multimodal fusion and adaptive model update mechanism enables the model to dynamically adjust the recognition strategy, significantly reducing false positives and false negatives and improving the stability and reliability of detection results; 4. Achieve intelligent protection: In conjunction with the Web application firewall, implement dynamic protection policies based on detection results, including alerts, isolation, or blocking of attack requests, thereby enhancing the security protection capabilities of the Web application system. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] The invention will be further described below with reference to the accompanying drawings.

[0020] Figure 1 This is a flowchart of a malicious traffic identification method based on an adaptive large model, as described in Example 1. Detailed Implementation

[0021] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0022] This invention provides a method and system for identifying malicious traffic based on an adaptive large model, which addresses the technical problem of how to improve the ability of Web application firewalls to identify complex attacks, variant attacks, and unknown attacks, and reduce false positive and false negative rates. Example

[0023] This invention provides a malicious traffic identification method based on an adaptive large model, comprising five steps: multimodal data acquisition, data preprocessing, multimodal feature modeling, inference analysis, and adaptive optimization.

[0024] Step S100 Multimodal Data Acquisition: Acquire multimodal data generated by Web application access. The multimodal data includes text modal data, statistical modal data, and time-series / graph modal data. Among them, text modal data is the full text information in the HTTP / HTTPS protocol extracted by traffic probe, statistical modal data is the statistical characteristics of the current session, and time-series / graph modal data is the access relationship graph based on IP-URL.

[0025] The specific implementation of multimodal data acquisition includes the acquisition of text modal data, statistical modal data, and time-series modal data.

[0026] Text modal data collection: Use traffic probes to extract full text information from the HTTP / HTTPS protocol, including URI path, query parameters, request body (including JSON / XML / Form-data), user-agent string, cookies, and custom headers.

[0027] Statistical modal data acquisition: Real-time calculation of the statistical characteristics of the current session: request packet size, response packet size, request interval time, request frequency per unit time, status code distribution (such as 404 / 500 ratio).

[0028] Time-series / graph modal data acquisition: Record access trajectories based on Session ID or IP, form API call sequences (e.g., / login -> / home -> / api / data), and construct an access relationship graph based on IP-URL.

[0029] Step S200 Data Preprocessing: Perform data preprocessing on the multimodal data. Through data preprocessing, the multimodal data is cleaned, parsed, formatted, and standardized to generate multimodal features. The multimodal features include text features corresponding to text modal data, statistical features corresponding to statistical modal data, and time-series behavioral features corresponding to time-series / graph modal data.

[0030] As a specific implementation of data preprocessing, when preprocessing multimodal data, textual modal data undergoes text cleaning and standardization, statistical modal data undergoes Z-Score standardization or Min-Max normalization, and time-series / graph modal data undergoes sequence truncation and padding. A sliding window is set to truncate behavioral sequences exceeding a predetermined length and pad insufficient behavioral sequences. The specific operations are as follows: (1) Text cleaning and standardization: URL decoding and Base64 decoding are performed on the URI and Payload. Simultaneously, generalization is performed, replacing specific numbers with... <num>Replace the random hash value with <hash>To eliminate noise and focus on the attack pattern structure; (2) Statistical feature normalization: Z-Score standardization or Min-Max normalization is used for numerical features such as request size and frequency to map them to [0,1] or standard normal distribution interval to prevent numerical differences from affecting gradient descent; (3) Sequence truncation and padding: Set the sliding window length L, truncate excessively long behavior sequences, and padding those that are insufficient.

[0031] Step S300 Multimodal Feature Modeling: Jointly model and extract features from multimodal features. Input text features into a pre-trained BERT encoder for deep semantic extraction to obtain text feature vectors. Input statistical features into a multilayer perceptron to map them into statistical characteristic vectors of the same dimension as the text vectors. Input temporal behavioral features into an LSTM network to extract temporally dependent feature vectors. Then, use a multi-head cross-attention mechanism to fuse text feature vectors, statistical feature vectors, and temporal feature vectors to obtain fused features.

[0032] In the process of fusing text feature vectors, statistical feature vectors, and temporal feature vectors through a multi-head cross-attention mechanism, the text feature vector is used as the query, and the statistical feature vector and behavioral feature vector are used as the key and value, respectively, to perform cross-modal feature fusion and obtain fused features.

[0033] Step S400 Inference Analysis: The fused features are input into the large model. The large model performs a progressive process of feature space adaptation, structured prompt guidance, and chain-like four-dimensional inference. The output includes the identification results of attack patterns, abnormal behaviors, and confidence scores. Malicious traffic is identified and protected based on the confidence scores, predetermined risk judgment criteria, and corresponding protection strategies.

[0034] In this embodiment, the large model includes an embedding layer, a Transformer layer, a pooling layer, and an output layer.

[0035] The Embedding layer uniformly encodes and fuses the mapping vectors of the fused features and the structured Prompt text of Web traffic analysis, and outputs a sequence of fused semantic vectors with a fixed dimension; the Transformer layer performs multi-head self-attention calculation and deep feature extraction with multiple layers stacked on the sequence of fused semantic vectors, mines the correlation relationships between traffic features and completes context reasoning, and outputs a sequence of high-dimensional deep reasoning features; the pooling layer performs hybrid pooling on the sequence of deep reasoning features to achieve feature aggregation and dimensionality reduction, and outputs a global core reasoning feature vector with a fixed dimension; the output layer classifies, quantifies and generates an inference path for the global core reasoning feature vector, and outputs a standardized inference result set containing classification labels, confidence scores, and chain-of-thought inference paths for the discrimination and protection of Web malicious traffic.

[0036] In this embodiment, semantic understanding and context reasoning are performed on the fused features based on a large model to identify potential attack patterns and abnormal behaviors, and capture complex attack chains and multi-stage attack features.

[0037] Prompt engineering construction: Map the fused features obtained in the above steps to the Embedding space of the large model, and combine the structured Prompt to input into the large model.

[0038] Prompt example: "Analyze the following Web traffic features. The context shows that this IP has accessed a sensitive interface 50 times within 1 minute (statistical feature), and the Payload contains a structure similar to SQL syntax (text feature). Please determine whether there is an attack intention." Chain-of-thought reasoning: Guide the large model to output the discrimination path. For example: Single quote closure detected, UNION keyword detected, combined with high-frequency access behavior, conclusion: High-confidence SQL injection.

[0039] The output of the large model consists of two parts: classification label and confidence score (Probability Score). At the same time, a policy mapping is set. Score > 0.9 (high risk): Trigger Block (block), and联动 the firewall to ban the IP for 1 hour. 0.6 < Score < 0.9 (suspicious): Trigger Challenge (human verification), send a JS challenge or verification code. Score < 0.6 (low risk): Log (allow and record), mark as "to be audited".

[0040] Step S500 adaptive optimization: Based on historical security data, identification results and online detection feedback, perform adaptive optimization on the large model.

[0041] The multi-head self-attention mechanism of the Transformer layer inserts low-rank adapters (LoRAAdapters) into the linear transformation layer. During adaptive optimization, it includes the following operations: (1) Obtain a large model detection sample set of new false positives and false negatives confirmed by security experts, and collect complete information on the latest false negative CVE vulnerabilities in online detection; (2) Lock the original parameters of the large model, and perform lightweight fine-tuning training on the parameters of LoRA Adapters only for the false positive and false negative sample sets. After verification, load the updated LoRA parameters into the Transformer layer of the online large model. (3) Extract core attack features from the latest unreported CVE vulnerability complete information, map the core attack features to the embedding space of the large model, transform them into feature vectors of the same dimension as the embedding space, and store the feature vectors in the CVE vulnerability knowledge base; (4) Link the updated CVE vulnerability knowledge base with the prompt engineering construction stage of the large model, and automatically retrieve the CVE vulnerability feature vectors in the knowledge base and incorporate them when constructing the structured Prompt; (5) Continuously monitor the online detection effect of the updated large model, and determine whether to trigger the next round of LoRA parameter update and CVE vulnerability knowledge base supplementation based on the preset evaluation indicators, so as to form an adaptive optimization closed loop.

[0042] This embodiment combines historical security data and online detection feedback to adaptively update the large model, optimizing its recognition capabilities and improving its detection performance against unknown attacks. Instead of fully fine-tuning the large model, low-rank adapters (LoRA Adapters) are inserted into the Transformer layer. When security experts confirm new false positives or false negatives, the LoRA parameters are updated only for these samples. Simultaneously, the latest false negative CVEs are converted into vectors and stored in the knowledge base.

[0043] The method in this embodiment collects web application access traffic, parses and preprocesses the traffic to construct structured data containing request content, access context, and behavioral characteristics; performs semantic understanding and contextual reasoning on the structured data based on a large model to achieve automatic learning and expression of web attack behavior characteristics; and adaptively optimizes the large model by combining historical security data and operating environment information, thereby achieving accurate identification and judgment of malicious traffic.

[0044] The method disclosed in this embodiment can effectively improve the Web application firewall's ability to identify complex attacks, variant attacks, and unknown attacks, reduce false alarm rate and false negative rate, and enhance the intelligent and adaptive defense capabilities of the Web application protection system.

[0045] The above provides a detailed description of the malicious traffic identification method and system based on an adaptive large model provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.< / hash> < / num>

Claims

1. A method for identifying malicious traffic based on an adaptive large model, characterized in that, Includes the following steps: Multimodal data acquisition: Collect multimodal data generated by web application access. The multimodal data includes text modal data, statistical modal data, and time-series / graph modal data. Among them, text modal data is the full text information in the HTTP / HTTPS protocol extracted by traffic probe, statistical modal data is the statistical characteristics of the current session, and time-series / graph modal data is the access relationship graph based on IP-URL. Data preprocessing: Data preprocessing is performed on multimodal data. Through data preprocessing, multimodal data is cleaned, parsed, formatted and standardized to generate multimodal features. Multimodal features include text features corresponding to text modal data, statistical features corresponding to statistical modal data, and time series behavioral features corresponding to time series / graph modal data. Multimodal feature modeling: Multimodal features are jointly modeled and extracted. Text features are input into a pre-trained BERT encoder for deep semantic extraction to obtain text feature vectors. Statistical features are input into a multilayer perceptron and mapped to statistical characteristic vectors of the same dimension as the text vectors. Temporal behavioral features are input into an LSTM network to extract temporally dependent feature vectors. Finally, the text feature vectors, statistical feature vectors, and temporal feature vectors are fused through a multi-head cross-attention mechanism to obtain fused features. Inference and analysis: The fused features are input into a large model, and the large model performs a progressive process of feature space adaptation, structured prompt guidance, and chain-like four-dimensional inference. The output includes the identification results of attack patterns, abnormal behaviors, and confidence scores. Based on the confidence scores, as well as the predetermined risk discrimination criteria and corresponding protection strategies, malicious traffic is identified and protection is implemented. Adaptive optimization: Based on historical security data, recognition results, and online detection feedback, the large model is adaptively optimized.

2. The malicious traffic identification method based on an adaptive large model according to claim 1, characterized in that, Text modal data includes URI path, query parameters, request body (including JSON / XML / Form-data), user-agent string, cookie, and custom header. The request body includes JSON, XML, and form-data. Statistical modal data includes request packet size, response packet size, request interval, request frequency per unit time, and status code distribution; When collecting time-series / graph modal data, record access trajectories based on Session ID or IP address to form API call sequences and construct an access relationship graph based on IP-URL.

3. The malicious traffic identification method based on an adaptive large model according to claim 1, characterized in that, When preprocessing multimodal data, text cleaning and standardization are performed on text modal data, Z-Score standardization or Min-Max normalization is performed on statistical modal data, and sequence truncation and completion operations are performed on time series / graph modal data. A sliding window is set to truncate behavioral sequences that exceed a predetermined length and padding is performed on behavioral sequences that are insufficient.

4. The malicious traffic identification method based on an adaptive large model according to claim 1, characterized in that, When fusing text feature vectors, statistical feature vectors, and temporal feature vectors using a multi-head cross-attention mechanism, the text feature vector is used as the query, and the statistical feature vector and behavioral feature vector are used as the key and value, respectively, to perform cross-modal feature fusion and obtain fused features.

5. The malicious traffic identification method based on an adaptive large model according to claim 1, characterized in that, The main model consists of an embedding layer, a Transformer layer, a pooling layer, and an output layer; The Embedding layer performs unified encoding and fusion of the mapping vector of the fused features and the structured Prompt text of Web traffic analysis, and outputs a fixed-dimensional sequence of fused semantic vectors. The Transformer layer performs multi-head self-attention computation and multi-layer stacked deep feature extraction on the fused semantic vector sequence, mines the correlation between traffic features and completes contextual reasoning, and outputs a high-dimensional deep reasoning feature sequence. The pooling layer performs hybrid pooling on the deep inference feature sequence to achieve feature aggregation and dimensionality reduction, and outputs a global core inference feature vector with fixed dimensions. The output layer classifies, quantifies, and generates inference paths for the global core inference feature vectors, and outputs a standardized inference result set containing classification labels, confidence scores, and chain-like inference paths, which is used for the identification and protection of malicious web traffic. The multi-head self-attention mechanism of the Transformer layer inserts low-rank adapters (LoRAAdapters) into the linear transformation layer. During adaptive optimization, the following operations are included: Obtain a large-scale model for detecting new false positives and false negatives, verified by security experts, and collect complete information on the latest false negative CVE vulnerabilities detected online. Lock the original parameters of the large model, and perform lightweight fine-tuning training on the parameters of LoRA Adapters only for the false positive and false negative sample sets. After verification, load the updated LoRA parameters into the Transformer layer of the online large model. Extract core attack features from the complete information of the latest unreported CVE vulnerabilities, map the core attack features to the embedding space of the large model, transform them into feature vectors of the same dimension as the embedding space, and store the feature vectors in the CVE vulnerability knowledge base; The updated CVE vulnerability knowledge base is linked with the prompt engineering construction phase of the large model. When constructing the structured Prompt, the CVE vulnerability feature vectors in the knowledge base are automatically retrieved and incorporated into it. Continuously monitor the online detection performance of the updated large model, and determine whether to trigger the next round of LoRA parameter updates and CVE vulnerability knowledge base supplementation based on preset evaluation indicators, forming an adaptive optimization closed loop.

6. A malicious traffic identification system based on an adaptive large model, characterized in that, It includes a multimodal data acquisition module, a data preprocessing module, a multimodal feature modeling module, an inference analysis module, and an adaptive optimization module; The multimodal data acquisition module is used to perform the following: acquire multimodal data generated by Web application access, wherein the multimodal data includes text modal data, statistical modal data and time series / graph modal data, wherein the text modal data is the full text information in the HTTP / HTTPS protocol extracted by traffic probe, the statistical modal data is the statistical characteristics of the current session, and the time series / graph modal data is the access relationship graph based on IP-URL; The data preprocessing module is used to perform the following: data preprocessing on multimodal data, cleaning, parsing, formatting and standardizing multimodal data through data preprocessing, generating multimodal features, including text features corresponding to text modal data, statistical features corresponding to statistical modal data, and time series behavioral features corresponding to time series / graph modal data; The multimodal feature modeling module performs the following operations: jointly modeling and extracting multimodal features; inputting text features into a pre-trained BERT encoder for deep semantic extraction to obtain text feature vectors; inputting statistical features into a multilayer perceptron to map them into statistical characteristic vectors of the same dimension as the text vectors; inputting temporal behavioral features into an LSTM network to extract temporally dependent feature vectors; and fusing text feature vectors, statistical feature vectors, and temporal feature vectors through a multi-head cross-attention mechanism to obtain fused features. The reasoning and analysis module is used to perform the following: inputting fused features into a large model, and through the large model, performing a progressive process of feature space adaptation, structured prompt guidance, and chain-like four-dimensional reasoning, outputting identification results including attack patterns, abnormal behaviors, and confidence scores, and performing malicious traffic identification and protection based on confidence scores, predetermined risk discrimination criteria, and corresponding protection strategies. The adaptive optimization module is used to perform the following: adaptive optimization of the large model based on historical security data, recognition results, and online detection feedback.

7. The malicious traffic identification system based on an adaptive large model according to claim 6, characterized in that, Text modal data includes URI path, query parameters, request body (including JSON / XML / Form-data), user-agent string, cookie, and custom header. The request body includes JSON, XML, and form-data. Statistical modal data includes request packet size, response packet size, request interval, request frequency per unit time, and status code distribution; When collecting time-series / graph modal data, record access trajectories based on Session ID or IP address to form API call sequences and construct an access relationship graph based on IP-URL.

8. The malicious traffic identification system based on an adaptive large model according to claim 6, characterized in that, When performing data preprocessing on multimodal data, the data preprocessing module is used to perform text cleaning and standardization on text modal data, Z-Score standardization or Min-Max normalization on statistical modal data, and sequence truncation and completion operations on time series / graph modal data. A sliding window is set to truncate behavioral sequences that exceed a predetermined length and padding completes behavioral sequences that are insufficient.

9. The malicious traffic identification system based on an adaptive large model according to claim 6, characterized in that, The multimodal feature modeling module is used to fuse text feature vectors, statistical feature vectors, and temporal feature vectors through a multi-head cross-attention mechanism. It uses text feature vectors as queries and statistical feature vectors and behavioral feature vectors as keys and values ​​to perform cross-modal feature fusion and obtain fused features.

10. The malicious traffic identification system based on an adaptive large model according to claim 6, characterized in that, The main model consists of an embedding layer, a Transformer layer, a pooling layer, and an output layer; The Embedding layer performs unified encoding and fusion of the mapping vector of the fused features and the structured Prompt text of Web traffic analysis, and outputs a fixed-dimensional sequence of fused semantic vectors. The Transformer layer performs multi-head self-attention computation and multi-layer stacked deep feature extraction on the fused semantic vector sequence, mines the correlation between traffic features and completes contextual reasoning, and outputs a high-dimensional deep reasoning feature sequence. The pooling layer performs hybrid pooling on the deep inference feature sequence to achieve feature aggregation and dimensionality reduction, and outputs a global core inference feature vector with fixed dimensions. The output layer classifies, quantifies, and generates inference paths for the global core inference feature vectors, and outputs a standardized inference result set containing classification labels, confidence scores, and chain-like inference paths, which is used for the identification and protection of malicious web traffic. In the Transformer layer, low-rank adapters (LoRAAdapters) are inserted into the linear transformation layer using the multi-head self-attention mechanism. The adaptive optimization module is used to perform the following operations: Obtain a large-scale model for detecting new false positives and false negatives, verified by security experts, and collect complete information on the latest false negative CVE vulnerabilities detected online. Lock the original parameters of the large model, and perform lightweight fine-tuning training on the parameters of LoRA Adapters only for the false positive and false negative sample sets. After verification, load the updated LoRA parameters into the Transformer layer of the online large model. Extract core attack features from the complete information of the latest unreported CVE vulnerabilities, map the core attack features to the embedding space of the large model, transform them into feature vectors of the same dimension as the embedding space, and store the feature vectors in the CVE vulnerability knowledge base; The updated CVE vulnerability knowledge base is linked with the prompt engineering construction phase of the large model. When constructing the structured Prompt, the CVE vulnerability feature vectors in the knowledge base are automatically retrieved and incorporated into it. Continuously monitor the online detection performance of the updated large model, and determine whether to trigger the next round of LoRA parameter updates and CVE vulnerability knowledge base supplementation based on preset evaluation indicators, forming an adaptive optimization closed loop.

Images