A payload threat intelligence generation method, system, device and medium based on multi-stage intelligent perception

Abstract

The present application relates to the technical field of network security, in particular to a Payload threat intelligence generation method, system, device and medium based on multi-stage intelligent perception; the method constructs a three-layer progressive processing architecture composed of a rule engine, a lightweight semantic understanding model and a security special small body large model, combines a dynamic routing mechanism and a confidence evaluation system, realizes full-process analysis from original Payload input to structured threat intelligence output, and supports multi-level response from milliseconds to seconds, effectively improving the automation level and practical applicability of malicious code detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method, system, device, and medium for generating payload threat intelligence based on multi-stage intelligent perception. Background Technology

[0002] In the current process of malicious payload detection and threat intelligence generation, traditional methods face a core contradiction: the difficulty of balancing efficiency and accuracy. On the one hand, lightweight detection methods based on rule matching, while offering fast response times (microseconds), have limited identification capabilities, struggle to handle complex variant samples, and suffer from high false positive rates. On the other hand, deep analysis methods relying on large models, while achieving higher accuracy, suffer from long processing latency (second-level response times) and high resource consumption, making it difficult to support large-scale concurrent requests. Furthermore, existing systems generally lack dynamic scheduling mechanisms, failing to make intelligent routing decisions based on sample complexity and system load, resulting in both wasted computing resources and insufficient processing power.

[0003] Meanwhile, traditional detection processes suffer from low transparency and poor controllability, lacking a hierarchical and progressive decision-making mechanism. This makes it difficult to extract and fuse multi-dimensional features from threat samples, limiting the quality and practicality of automated threat intelligence output. Faced with increasingly complex cyberattack methods and the continuous growth of massive amounts of malicious samples, there is an urgent need for an intelligent threat detection and intelligence generation solution that can improve processing efficiency and optimize resource utilization while ensuring detection accuracy. Summary of the Invention

[0004] This invention addresses the shortcomings of traditional detection methods, which cannot simultaneously achieve accuracy and efficiency and produce low-quality intelligence. It proposes a payload threat intelligence generation method, system, device, and medium based on multi-stage intelligent perception. By constructing a three-layer progressive processing architecture consisting of a rule engine, a lightweight semantic understanding model, and a security-specific small-scale large-scale model, combined with a dynamic routing mechanism and a confidence evaluation system, it realizes the entire process analysis from raw payload input to structured threat intelligence output, and supports multi-level responses at the millisecond to second level, effectively improving the automation level and practical applicability of malicious code detection.

[0005] The specific implementation details of this invention are as follows: A method for generating payload threat intelligence based on multi-stage intelligent perception specifically includes the following steps: Step S1: Preprocess the acquired raw payload data to be analyzed, decode it to obtain a standardized sequence, and extract multimodal features; Step S2: Input the standardized sequence into the constructed three-layer detection model to obtain the layer confidence and structured intelligence fields; the three-layer detection model includes a fast filtering layer, a semantic understanding layer, and a deep parsing layer; Step S3: Generate a unified analysis fact set based on structured intelligence fields and multimodal features, and output the consistent threat intelligence to the threat intelligence platform.

[0006] To better realize the present invention, step S1 further includes the following steps: Step S11: Obtain the raw payload data to be analyzed from the detection and processing link entry point; Step S12: Based on the original payload data format to be analyzed, perform the corresponding structured decoding and restoration to obtain the standardized sequence; Step S13: Extract features from the standardized sequence according to the set feature dimensions to obtain multimodal features; Step S14: Normalize the multimodal features to obtain the normalized score; Step S15: Calculate the complexity score based on the normalized score and the set weight coefficients.

[0007] To better realize the present invention, step S2 further includes the following steps: Step S21: Input the standardized sequence into the fast filtering layer for rule matching and fingerprint index query to obtain the hit rules and initial screening confidence. Step S22: Input the standardized sequence of the missed rules into the semantic understanding layer to obtain the layer confidence, and obtain the suspicious samples according to the set dynamic routing mechanism; Step S23: Input the suspicious samples and multimodal features into the pre-trained large model, and call the template parser to map and obtain the structured intelligence fields.

[0008] To better realize the present invention, step S3 further includes the following steps: Step S31: Aggregate structured intelligence fields and multimodal features to generate a unified analysis fact set; Step S32: Based on the pre-configured intelligence field mapping table, map the unified analysis fact set to the attribute slots in the target intelligence pattern; Step S33: If different sources give different values ​​for the same slot, then conflict resolution and fusion are performed according to the preset priority strategy or the confidence weight of each source to obtain the intermediate state of structured intelligence record. Step S34: Record the structured intelligence of the intermediate state, and perform object type mapping and attribute serialization according to the selected target specification; Step S35: Perform mandatory field verification, value range verification, reference integrity verification, and cross-field consistency verification on the serialized intelligence fields; Step S36: Output the threat intelligence after consistency verification to the threat intelligence platform.

[0009] To better implement the present invention, step S21 further includes the following steps: Step S211: Compile YARA-type rules, regular expressions, and feature libraries into a matching structure that can be scanned in parallel, calculate segmented hash and rolling hash based on the standardized sequence, and generate a static fingerprint; Step S212: Build a malicious fingerprint index based on the calculated segmented hash, rolling hash, and static fingerprint; Step S213: Perform rule matching and fingerprint index query on the standardized sequence. If a rule is matched, output the rule identifier, label and initial screening confidence. If no rule is matched or the initial screening confidence is lower than the set initial screening threshold, output it as a candidate sample to the semantic understanding layer.

[0010] To better realize the present invention, step S22 further includes the following steps: Step S221: The standardized sequence of the rule-missing sequence is segmented into words and sub-words and then input into a DistilBERT-type lightweight encoder. After multi-layer Transformer encoding, the segment-level semantic embedding vector is obtained. Step S222: Construct a directed graph based on the API call sequence, control flow edges, and session relationships. Nodes and edges carry type, frequency, or entropy features, and the graph-level embedding vector is obtained through information propagation in the graph neural network layer. Step S223: Concatenate the segment-level semantic embedding vector and the graph-level embedding vector, and input them into the classification head to obtain the threat category probability distribution and layer confidence. Step S224: Based on the set dynamic routing mechanism and layer confidence, obtain suspicious samples.

[0011] To better realize the present invention, step S23 further includes the following steps: Step S231: Input the suspicious sample and multimodal features into the pre-trained large model and encode the prompt context; Step S232: Inject K example question-answer pairs with features similar to the current sample into the prompt context based on the Few-shot example; and retrieve the corresponding entries from the threat intelligence knowledge base based on the RAG fragment using embedding vector retrieval or keyword retrieval and concatenate them into the context; Step S233: Employ a chain-thinking constraint model to output threat assessment, MITRE ATT&CK mapping, IoC and handling suggestions in steps, and then map them into structured intelligence fields through a template parser.

[0012] Based on the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception, in order to better realize this invention, a system for generating payload threat intelligence based on multi-stage intelligent perception is further proposed, which is used to execute the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception; including a preprocessing and feature extraction unit, a multi-stage progressive detection and analysis unit, and a threat intelligence structured output unit. The preprocessing and feature extraction unit is used to preprocess the acquired raw payload data to be analyzed, decode the standardized sequence, and extract multimodal features. The multi-stage progressive detection and analysis unit is used to input standardized sequences into the constructed three-layer detection model to obtain layer confidence and structured intelligence fields; the three-layer detection model includes a fast filtering layer, a semantic understanding layer, and a deep parsing layer; The threat intelligence structured output unit is used to generate a unified analysis fact set based on structured intelligence fields and multimodal features, and output the consistent threat intelligence to the threat intelligence platform.

[0013] Based on the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception, to better realize this invention, an electronic device is further proposed, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception is implemented.

[0014] Based on the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception, and to better realize this invention, a computer-readable storage medium is further proposed, wherein computer instructions are stored on the computer-readable storage medium; when the computer instructions are executed on the aforementioned electronic device, the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception is realized.

[0015] The present invention has the following beneficial effects: (1) This invention proposes a three-layer progressive processing architecture consisting of a fast filtering layer (μs level), a semantic understanding layer (ms level), and a deep parsing layer (s level). The complexity assessment and confidence judgment determine whether a sample enters the next layer of analysis, thus avoiding invalid computation.

[0016] (2) The first layer of this invention compiles the rule base into a parallel scanning structure, and combines SIMD parallel comparison with hash table / Bloom filter fingerprint index to complete the initial screening; the second layer obtains semantic embedding by passing the text branch through DistilBERT-like encoder, constructs the calling relationship into a graph and obtains graph embedding through graph neural network, and then fuses the decision output category and confidence; combining traditional feature matching and AI semantic understanding, it takes into account both speed and accuracy.

[0017] (3) The third layer of this invention adopts a security-specific large model with 1B-7B parameters. The base can use weights obtained by offline distillation, pre-training and fine-tuning such as Qwen3-0.6B. During online inference, the summary and multimodal features are encoded as prompts. Combined with Few-shot examples, RAG knowledge base retrieval and CoT step-by-step output, the structured intelligence fields are generated by the parser. For the first time, a customized compressed large model is applied to the deep analysis of malicious code and the reconstruction of attack chains.

[0018] (4) The present invention can automatically adjust the processing boundaries and confidence thresholds of each layer according to the real-time load and sample complexity, thereby maximizing resource utilization and optimizing throughput. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the first stage process provided for the present invention.

[0020] Figure 2 This is a schematic diagram of the third stage process provided by the present invention. Detailed Implementation

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments, and therefore should not be regarded as a limitation on the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "set up," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0023] The technical terms and definitions used in this embodiment are as follows: Payload: In the field of network security, payload refers to the actual data content carried in network communication, especially potential malicious code or attack payloads. Common types include scripts (such as PowerShell and JavaScript), binary files (such as PE and ELF), network traffic (HTTP requests and DNS queries), and documents (Office documents, PDFs), etc.

[0024] Threat Intelligence: Structured information used to describe cybersecurity incidents, including attack sources, attack methods, attack targets, Indicator of Indicators (IoCs), MITRE ATT&CK mappings, etc., aiming to provide actionable basis for defense measures.

[0025] Multi-Stage Intelligent Perception Architecture: A layered and progressive threat detection architecture consisting of a fast filtering layer, a semantic understanding layer, and a deep parsing layer. It uses a dynamic routing mechanism to determine whether a sample enters the next layer of processing, achieving a balance between efficient resource scheduling and accurate threat analysis.

[0026] Dynamic Routing Mechanism: Given that the sample complexity score has been calculated in the first stage and the layer confidence score has been calculated after each layer has completed its analysis, the layer confidence score is compared with the corresponding layer's preset or adaptively updatable threshold. Combined with the complexity score and system load strategy, the mechanism automatically determines whether the sample should continue to the next processing layer, ensuring that the system improves overall processing efficiency while ensuring detection accuracy.

[0027] Security-Specific Lightweight LLM: A small-scale language model (usually with 1B-7B parameters) optimized for cybersecurity scenarios. It has the ability to analyze malicious code, reason about tactics and techniques, and reconstruct attack chains, achieving low resource consumption and fast response while ensuring high accuracy.

[0028] Progressive Threat Detection: A threat identification method that allocates computing resources on demand. It improves the depth and accuracy of threat identification through a hierarchical analysis process from simple to complex, balancing detection speed and analysis capabilities.

[0029] Confidence Assessment: After completing the inference of its own layer, each layer outputs a normalized or mapped layer confidence scalar, which is compared with the corresponding layer threshold to participate in routing. The confidence is a computational quantity rather than a simply manually set constant, while the threshold is a preset or adaptively adjustable decision boundary parameter.

[0030] Structured Threat Intelligence Output: After the analytical facts from each layer are aggregated, field-mapped, and extracted and integrated into structured records, they are serialized and output in standard formats (such as STIX, MISP, JSON, etc.) to facilitate subsequent automated processing, sharing, and integration.

[0031] Resource Scheduling and Load Balancing: Based on real-time system load and sample complexity, dynamically adjust the processing boundaries and thresholds of each layer to improve overall resource utilization and system throughput.

[0032] Pre-training: Pre-training refers to the process of initially training an artificial intelligence model using a large-scale general dataset, enabling the model to learn fundamental knowledge and general features such as language, semantics, and pattern recognition. Through pre-training, the model acquires broad representational capabilities without specific task constraints, thus providing foundational support for subsequent specific tasks.

[0033] Fine-tuning: Fine-tuning refers to the process of further training a pre-trained model using a specialized dataset highly relevant to the target task to adjust and optimize its parameters. Through fine-tuning, the model can transfer and adapt the general knowledge gained in the pre-training stage to specific application scenarios, thereby significantly improving its performance and accuracy on specific tasks.

[0034] Example 1: This embodiment proposes a payload threat intelligence generation method based on multi-stage intelligent perception. The method specifically includes the following steps: Step S1: Preprocess the acquired raw payload data to be analyzed, decode it to obtain a standardized sequence, and extract multimodal features; Step S1 specifically includes the following steps: Step S11: Obtain the raw payload data to be analyzed from the detection and processing link entry point; Step S12: Based on the original payload data format to be analyzed, perform the corresponding structured decoding and restoration to obtain the standardized sequence; Step S13: Extract features from the standardized sequence according to the set feature dimensions to obtain multimodal features; Step S14: Normalize the multimodal features to obtain the normalized score; Step S15: Calculate the complexity score based on the normalized score and the set weight coefficients.

[0035] Step S2: Input the standardized sequence into the constructed three-layer detection model to obtain the layer confidence and structured intelligence fields; the three-layer detection model includes a fast filtering layer, a semantic understanding layer, and a deep parsing layer; Step S2 specifically includes the following steps: Step S21: Input the standardized sequence into the fast filtering layer for rule matching and fingerprint index query to obtain the hit rules and initial screening confidence. Step S21 specifically includes the following steps: Step S211: Compile YARA-type rules, regular expressions, and feature libraries into a matching structure that can be scanned in parallel, calculate segmented hash and rolling hash based on the standardized sequence, and generate a static fingerprint; Step S212: Build a malicious fingerprint index based on the calculated segmented hash, rolling hash, and static fingerprint; Step S213: Perform rule matching and fingerprint index query on the standardized sequence. If a rule is matched, output the rule identifier, label and initial screening confidence. If no rule is matched or the initial screening confidence is lower than the set initial screening threshold, output it as a candidate sample to the semantic understanding layer.

[0036] Step S22: Input the standardized sequence of the missed rules into the semantic understanding layer to obtain the layer confidence, and obtain the suspicious samples according to the set dynamic routing mechanism; Step S22 specifically includes the following steps: Step S221: The standardized sequence of the rule-missing sequence is segmented into words and sub-words and then input into a DistilBERT-type lightweight encoder. After multi-layer Transformer encoding, the segment-level semantic embedding vector is obtained. Step S222: Construct a directed graph based on the API call sequence, control flow edges, and session relationships. Nodes and edges carry type, frequency, or entropy features, and the graph-level embedding vector is obtained through information propagation in the graph neural network layer. Step S223: Concatenate the segment-level semantic embedding vector and the graph-level embedding vector, and input them into the classification head to obtain the threat category probability distribution and layer confidence. Step S224: Based on the set dynamic routing mechanism and layer confidence, obtain suspicious samples.

[0037] Step S23: Input the suspicious samples and multimodal features into the pre-trained large model, and call the template parser to map and obtain the structured intelligence fields.

[0038] Step S23 specifically includes the following steps: Step S231: Input the suspicious sample and multimodal features into the pre-trained large model and encode the prompt context; Step S232: Inject K example question-answer pairs with features similar to the current sample into the prompt context based on the Few-shot example; and retrieve the corresponding entries from the threat intelligence knowledge base based on the RAG fragment using embedding vector retrieval or keyword retrieval and concatenate them into the context; Step S233: Employ a chain-thinking constraint model to output threat assessment, MITRE ATT&CK mapping, IoC and handling suggestions in steps, and then map them into structured intelligence fields through a template parser.

[0039] Step S3: Generate a unified analysis fact set based on structured intelligence fields and multimodal features, and output the consistent threat intelligence to the threat intelligence platform.

[0040] Step S3 specifically includes the following steps: Step S31: Aggregate structured intelligence fields and multimodal features to generate a unified analysis fact set; Step S32: Based on the pre-configured intelligence field mapping table, map the unified analysis fact set to the attribute slots in the target intelligence pattern; Step S33: If different sources give different values ​​for the same slot, then conflict resolution and fusion are performed according to the preset priority strategy or the confidence weight of each source to obtain the intermediate state of structured intelligence record. Step S34: Record the structured intelligence of the intermediate state, and perform object type mapping and attribute serialization according to the selected target specification; Step S35: Perform mandatory field verification, value range verification, reference integrity verification, and cross-field consistency verification on the serialized intelligence fields; Step S36: Output the threat intelligence after consistency verification to the threat intelligence platform.

[0041] Working Principle: This embodiment constructs a three-layer progressive processing architecture consisting of a rule matching engine, a lightweight semantic understanding model, and a security-specific small-scale large-scale model to achieve efficient detection and structured intelligence output for various malicious payloads. At the input layer, the method performs format recognition, decoding, and four-dimensional feature extraction on the original payload, and determines the sample processing path based on complexity scores. The processing layer employs a dynamic routing mechanism, sequentially passing through a fast filtering layer (microsecond-level response), a semantic understanding layer (millisecond-level analysis), and a deep parsing layer (second-level inference). A confidence assessment system is used to determine whether a sample enters the next processing layer, ensuring a significant improvement in overall efficiency while maintaining accuracy. The output layer aggregates the analysis results from each layer, maps intelligence field slots, extracts rules from natural language results, and fuses multiple sources to form structured records. These records are then format-adapted and output as standardized threat intelligence in formats such as STIX, MISP, and JSON. A quality control module is integrated to ensure the integrity and consistency of the output content. Furthermore, for the security-specific small-scale large-scale model used in the third layer of deep analysis, during the offline training phase before system deployment, DeepSeek R1 was used to distill the threat intelligence analysis and collection dataset to enhance data quality and knowledge density. Pre-training was performed using Qwen3-0.6B as a base to inject threat intelligence analysis knowledge, and fine-tuning was performed based on threat intelligence classification data, enabling the model to possess high-precision threat intelligence classification and generation capabilities for payloads. During online inference, the model collaborates with Few-shot learning, Retrieval Enhanced Generation (RAG), and Chained Reasoning (CoT) to complete deep analysis, resolving the core contradiction of difficulty in achieving both accuracy and efficiency in traditional detection methods. Through knowledge injection and enhanced classification capabilities, the automation level and practical applicability of malware detection and threat intelligence generation are significantly improved.

[0042] Example 2: This embodiment is based on the above embodiment 1, such as... Figure 1 , Figure 2 As shown, a specific embodiment will be described in detail.

[0043] This embodiment achieves efficient detection of malicious payloads and output of structured threat intelligence by constructing a three-layer progressive processing architecture. The entire process is divided into three core stages: input preprocessing and feature extraction, multi-stage progressive detection and analysis, and structured output of threat intelligence.

[0044] Phase 1: Input preprocessing and feature extraction; (1) Obtaining raw payload data: At the entry point of the detection and processing link, the raw payload input data of the object to be analyzed is received. The raw payload input data includes one or more of the following: raw payload byte stream, file content, protocol payload content, or data fragments obtained by acquisition, which serve as the unified input data for each subsequent processing stage.

[0045] (2) Format recognition and decoding: Based on one or more of the Magic Number / Signature, protocol header fields, parsable file header structure, and script syntax keyword features presented in the original Payload input data, determine its type (such as script type, binary type, network traffic type, document type, etc.); for the encoded, compressed or encapsulated content, perform the restoration according to the structured decoding rules corresponding to the type to obtain a standardized byte sequence or text sequence that can be used for feature extraction; (3) Four-dimensional feature extraction and its association with subsequent stages: Features are extracted from four dimensions: static, structural, behavioral, and contextual, forming a multimodal feature set. Among them, the static dimension includes at least entropy value, byte distribution, string and hash-type indicators; the structural dimension includes at least segment length, call relationship or graph structure description; the behavioral dimension includes at least suspicious instruction sequence, API or network behavior pattern; and the contextual dimension includes at least source session attributes, time window and associated entity information. Among them, the API call sequence, control flow edge and session relationship data in the behavioral and structural dimension features can be obtained through one or more of the following methods: static parsing, dynamic execution monitoring, sandbox behavior collection, protocol parsing, log extraction or runtime monitoring. For samples where the runtime behavior cannot be directly obtained, the corresponding behavior representation can be generated based on code structure recovery, rule inference or simulated execution. The extracted API call sequence, control flow edge and session relationship are used as the data source for the subsequent semantic understanding layer to construct directed graphs and graph neural networks. The multimodal features are used for: (a) as input to the complexity score in step (4); (b) as input representation for the lightweight semantic model and graph neural network in the second-stage semantic understanding layer, used for semantic discrimination and sequence / graph structure modeling; (c) as the query basis for retrieval enhancement generation and auxiliary context for large model reasoning in the second-stage deep parsing layer; and (d) as supporting basis for IoC extraction, risk fields and tactical mapping in the third-stage structured threat intelligence generation. (4) Normalize the four-dimensional features obtained in step (3) to obtain the four-dimensional normalized scores fs, ft, fb, and fc for static, structural, behavioral, and contextual aspects, with each value ranging from [0,1]. Assume that the non-negative weight coefficients ωs, ωt, ωb, and ωc satisfy ωs+ωt+ωb+ωc=1, then the sample complexity score is calculated using the following formula: Where C∈[0,1]. Here, fs is obtained by normalizing entropy, confusion, and shelling indicator; ft is obtained by normalizing structural depth, number of segments, or graph complexity; fb is obtained by normalizing suspicious operation density and abnormal pattern count; and fc is obtained by normalizing external intelligence matching degree, associated alarms, or session anomaly degree. The weights can be preset according to the business scenario or determined through offline statistical calibration. The complexity score C is used to compare with the dynamic routing threshold to determine whether a sample enters the semantic understanding layer and deep parsing layer; (5) Output the multimodal features, complexity score C and type determination results to the second stage for use in dynamic routing and detection at each layer.

[0046] Phase Two: Multi-stage progressive detection and analysis.

[0047] It adopts a three-layer progressive architecture, combining a dynamic routing mechanism and a confidence evaluation system, and sequentially passes through a fast filtering layer, a semantic understanding layer and a deep parsing layer to improve detection accuracy step by step.

[0048] The functions of each layer are described in Table 1 below.

[0049] Table 1. Functional Table Corresponding to Hierarchy

[0050] The technical implementation of each layer is described in detail (corresponding to the table above, clearly defining data flow and interfaces): (i) Fast Filtering Layer: The input is the standardized byte sequence or text sequence and type identifier of the first stage output; the processing is a pipeline execution of rule matching and fingerprint index query, and the output is {whether it is hit, the set of hit rules or fingerprints, and the initial screening confidence}; this output, together with the sample complexity score C, participates in dynamic routing to determine whether the sample enters the semantic understanding layer or directly enters the deep parsing layer (depending on the strategy configuration).

[0051] (ii) Semantic Understanding Layer: The input is the samples that need to be further analyzed after the first layer of screening and their multimodal feature subsets; the processing is parallel branch - text branch is encoded by DistilBERT, graph branch is encoded by GNN - and then fused for decision; the output is {threat category or distribution, semantic embedding, graph-level features, confidence of this layer}; when the confidence is lower than the preset threshold, or the category is pending / high risk, or the dynamic routing strategy requires, the sample and feature package are passed to the deep parsing layer.

[0052] (III) Deep Parsing Layer: The input consists of high-risk or suspicious samples from the second layer, retrieval keys (for RAG), and the necessary context for hints. The processing involves a small-scale, large-model autoregressive generation process, combining Few-shot examples and RAG fragments to expand the context, and outputting parsable text after CoT format constraints. The output consists of {natural language inference chain, structured intelligence draft fields}, which are then handed over to the third stage for format adaptation and quality control. The division of responsibilities between offline training and online inference for the model used in the third layer before deployment is as follows: The offline stage completes data distillation, domain pre-training, and task fine-tuning to obtain the weight file; the online stage only performs forward inference and retrieval assembly, and does not include the above training iterations.

[0053] Offline training and deployment of small-scale, high-performance security models: The distillation, pre-training, and fine-tuning described above are only for the security-specific small-volume large model used in the third layer of deep analysis. They are completed in the offline stage before the system goes online and are not part of the online time-series stages such as input preprocessing, multi-stage detection, and structured intelligence output. Specifically, they include: (1) Data distillation: using DeepSeek R1 to distill threat intelligence analysis and collection datasets to obtain high-quality, high-knowledge-density training samples (such as instruction following or conversational threat analysis data) for subsequent model learning; (2) Domain pre-training: using Qwen3-0.6B as the base model, pre-training or continuing pre-training is performed on the distilled and enhanced data to inject threat intelligence analysis domain knowledge; (3) Task fine-tuning: supervised fine-tuning or data alignment is performed based on task data such as threat intelligence classification to enable the model to have high-precision classification and structured threat intelligence generation capabilities for payloads; (4) Deployment loading: the trained model weights are loaded into the deep analysis layer, and the online inference stage works in conjunction with Few-shot learning, RAG retrieval enhancement, and CoT chain inference to complete the deep analysis of high-risk samples. The training and updating of the models used in the first-layer rule engine and the second-layer semantic understanding can be configured independently, and do not necessarily adopt the same distillation-pre-training-fine-tuning process as the third layer.

[0054] Dynamic routing mechanism: The sample complexity score C is calculated by the weighted formula mentioned above in the first stage and is a real value; the confidence of each layer is obtained by the output of the layer after completing the detection or inference of this layer and then normalized, and is a comparable scalar. Among them, the layer confidence of the fast filtering layer can be mapped to [0,1] by rule hit score, fingerprint similarity or weighted fusion; the layer confidence of the semantic understanding layer can be obtained by the maximum class probability given by the classification head or its equivalent marginal confidence; the layer confidence of the deep parsing layer can be obtained by mapping one or a combination of the output of the auxiliary discrimination branch, the consistency score of the generated answer or the consistency of multiple rounds of sampling. The confidence thresholds T1, T2, and T3 for each layer are decision boundary parameters with the same dimensions as the confidence of the corresponding layer. They are pre-configured by the system, or calibrated offline in conjunction with historical false alarm / missed alarm statistics, or adaptively updated during operation based on load and feedback. During dynamic routing, the confidence calculated for this layer is compared with the corresponding threshold, and jointly judged with the sample complexity score C and the strategy table (such as skipping layers for low-complexity samples and forcing in-depth analysis for high-complexity samples) to determine whether to continue to the next layer for processing. Based on the judgment results, computing resources and queue priorities are allocated to each layer to avoid repeated deep calculations on samples that have passed high confidence judgments, thereby achieving optimal resource scheduling and reducing invalid calculations. By combining real-time queue length with the utilization rate of services at each layer, the threshold or skip-layer strategy can be fine-tuned to support real-time load balancing and automatically adjust the decision boundary.

[0055] Phase 3: Structured output of threat intelligence.

[0056] The main process is as follows: Intelligence generation module: Before the structured output, the analysis results of each layer of the second stage are aggregated with the indexable items in the multimodal features obtained in the first stage to form a unified analysis fact set for intelligence generation; the analysis fact set includes at least the rule / fingerprint hit identifier of the fast filtering layer, the category label and layer confidence of the semantic understanding layer, and the key-value pairs and natural language reasoning fragments obtained by the template parser in the deep parsing layer. Based on the pre-configured intelligence field mapping table, the above facts are mapped to the attribute slots in the target intelligence pattern. Results that are already key-value structures are directly written into the corresponding slots. For natural language fragments, IoC, MITRE ATT&CK related identifiers, risk level and handling suggestion fields are separated and filled from the text through pre-configured information extraction templates, pattern matching rules or named entity recognition rules. When different sources give different values ​​for the same slot, conflict resolution and fusion are carried out according to a preset priority strategy or the confidence weight of each source to obtain an intermediate structured intelligence record. The above steps are an orderly technical process of data aggregation, slot mapping, text field extraction and multi-source fusion, thereby forming structured threat intelligence content that can be converted and verified. Format adaptation module: Maps the structured intelligence records to object types and serializes attributes according to the selected target exchange specification, supporting standard format output such as STIX, MISP, and JSON; Quality control module: Performs checks on required fields, value range, reference integrity, and cross-field consistency on the serialized intelligence fields; Feedback optimization module: The analysis conclusions or error annotations after quality control are fed back to the model update pipeline in the form of data records for sample augmentation or threshold adjustment, supporting continuous learning and model version updates (optional). The intelligence data, after passing quality control, will be output to the threat intelligence platform or user interface.

[0057] Working Principle: This embodiment adopts a three-layer progressive architecture design. The first layer: rule compilation and SIMD parallel matching, fingerprint indexing for initial screening, outputting rule hit and initial screening confidence. The second layer: DistilBERT semantic encoding and graph neural network fusion classification, outputting category and layer confidence. The third layer: security-specific small-scale large-scale deep analysis (offline training to obtain weights, online prompt encoding + Few-shot + RAG + CoT, parsing into structured intelligence fields). The dynamic routing mechanism proposed in this embodiment uses layer confidence calculated from each layer forward, with threshold and complexity scores jointly serving as preset or adaptive decision boundaries; adaptive threshold adjustment and policy table-driven hierarchical routing; real-time load balancing scheduling strategy. The structured threat intelligence output of this embodiment analyzes fact aggregation and intelligence field slot mapping. Natural language results are filled with IoC and tactical fields through template / rule extraction. Multi-source field conflicts are fused according to priority or confidence, and then serialized into STIX, MISP, JSON, etc., through format adaptation. ATT&CK mapping, risk scoring, and handling recommendations are incorporated into the quality control process for verification; this embodiment features a cross-layer collaboration and feedback optimization mechanism, an inter-layer information transmission mechanism, model hot loading and updating, and continuous learning based on analyst feedback.

[0058] This embodiment proposes a three-layer progressive malicious payload layered detection mechanism, consisting of a fast filtering layer (μs level), a semantic understanding layer (ms level), and a deep parsing layer (s level). It determines whether a sample enters the next layer of analysis through complexity evaluation and confidence judgment, avoiding invalid computation. It also includes an automated sample path decision mechanism based on a hierarchical processing model.

[0059] This embodiment integrates a hybrid analysis process combining a rule matching engine and a lightweight AI model. The first layer compiles the rule base into a parallel scanning structure, and performs initial screening by combining SIMD parallel comparison with hash table / Bloom filter fingerprint index. The second layer obtains semantic embeddings by passing text branches through a DistilBERT-like encoder, constructs graphs such as call relationships into graphs and obtains graph embeddings through graph neural networks, and then fuses the decision output category and confidence level. It combines traditional feature matching and AI semantic understanding, balancing speed and accuracy. It covers the structural design and implementation of rule + lightweight model collaborative analysis.

[0060] This embodiment applies a security-specific small-scale large-scale model to threat intelligence generation. The third layer uses a security-specific large-scale model with 1B-7B parameters. The base can use weights obtained through offline distillation, pre-training, and fine-tuning, such as Qwen3-0.6B. During online inference, the summary and multimodal features are encoded as clues. Combined with Few-shot examples, RAG knowledge base retrieval, and CoT step-by-step output, the parser generates structured intelligence fields. This is the first time that a customized compressed large-scale model has been applied to deep analysis of malicious code and attack chain reconstruction. It covers small-scale language model training methods, context understanding mechanisms, and inference processes for network security.

[0061] This embodiment is based on a load-balanced dynamic routing and threshold adaptive adjustment mechanism. The system can automatically adjust the processing boundaries and confidence thresholds of each layer according to the real-time load and sample complexity; to maximize resource utilization (>95%) and optimize throughput; and covers dynamic routing algorithms, resource scheduling strategies and feedback optimization mechanisms.

[0062] The other parts of this embodiment are the same as those in Embodiment 1 above, so they will not be described again.

[0063] Example 3: Based on any one of Embodiments 1-2 above, this embodiment proposes a Payload threat intelligence generation system based on multi-stage intelligent perception, used to execute the above-mentioned Payload threat intelligence generation method based on multi-stage intelligent perception; including a preprocessing and feature extraction unit, a multi-stage progressive detection and analysis unit, and a threat intelligence structured output unit. The preprocessing and feature extraction unit is used to preprocess the acquired raw payload data to be analyzed, decode the standardized sequence, and extract multimodal features. The multi-stage progressive detection and analysis unit is used to input standardized sequences into the constructed three-layer detection model to obtain layer confidence and structured intelligence fields; the three-layer detection model includes a fast filtering layer, a semantic understanding layer, and a deep parsing layer; The threat intelligence structured output unit is used to generate a unified analysis fact set based on structured intelligence fields and multimodal features, and output the consistent threat intelligence to the threat intelligence platform.

[0064] This embodiment also proposes an electronic device, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements the above-described method for generating payload threat intelligence based on multi-stage intelligent perception.

[0065] This embodiment also proposes a computer-readable storage medium storing computer instructions; when the computer instructions are executed on the aforementioned electronic device, the aforementioned method for generating payload threat intelligence based on multi-stage intelligent perception is implemented.

[0066] The other parts of this embodiment are the same as any one of the above embodiments 1-2, so they will not be described again.

[0067] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for generating payload threat intelligence based on multi-stage intelligent perception, characterized in that, Specifically, the following steps are included: Step S1: Preprocess the acquired raw payload data to be analyzed, decode it to obtain a standardized sequence, and extract multimodal features; Step S2: Input the standardized sequence into the constructed three-layer detection model to obtain the layer confidence and structured intelligence fields; the three-layer detection model includes a fast filtering layer, a semantic understanding layer, and a deep parsing layer; Step S3: Generate a unified analysis fact set based on structured intelligence fields and multimodal features, and output the consistent threat intelligence to the threat intelligence platform.

2. The method for generating payload threat intelligence based on multi-stage intelligent perception according to claim 1, characterized in that, Step S1 specifically includes the following steps: Step S11: Obtain the raw payload data to be analyzed from the detection and processing link entry point; Step S12: Based on the original payload data format to be analyzed, perform the corresponding structured decoding and restoration to obtain the standardized sequence; Step S13: Extract features from the standardized sequence according to the set feature dimensions to obtain multimodal features; Step S14: Normalize the multimodal features to obtain the normalized score; Step S15: Calculate the complexity score based on the normalized score and the set weight coefficients.

3. The method for generating payload threat intelligence based on multi-stage intelligent perception according to claim 2, characterized in that, Step S2 specifically includes the following steps: Step S21: Input the standardized sequence into the fast filtering layer for rule matching and fingerprint index query to obtain the hit rules and initial screening confidence. Step S22: Input the standardized sequence of the missed rules into the semantic understanding layer to obtain the layer confidence, and obtain the suspicious samples according to the set dynamic routing mechanism; Step S23: Input the suspicious samples and multimodal features into the pre-trained large model, and call the template parser to map and obtain the structured intelligence fields.

4. The method for generating payload threat intelligence based on multi-stage intelligent perception according to claim 3, characterized in that, Step S3 specifically includes the following steps: Step S31: Aggregate structured intelligence fields and multimodal features to generate a unified analysis fact set; Step S32: Based on the pre-configured intelligence field mapping table, map the unified analysis fact set to the attribute slots in the target intelligence pattern; Step S33: If different sources give different values ​​for the same slot, then conflict resolution and fusion are performed according to the preset priority strategy or the confidence weight of each source to obtain the intermediate state of structured intelligence record. Step S34: Record the structured intelligence of the intermediate state, and perform object type mapping and attribute serialization according to the selected target specification; Step S35: Perform mandatory field verification, value range verification, reference integrity verification, and cross-field consistency verification on the serialized intelligence fields; Step S36: Output the threat intelligence after consistency verification to the threat intelligence platform.

5. The method for generating payload threat intelligence based on multi-stage intelligent perception according to claim 3, characterized in that, Step S21 specifically includes the following steps: Step S211: Compile YARA-type rules, regular expressions, and feature libraries into a matching structure that can be scanned in parallel, calculate segmented hash and rolling hash based on the standardized sequence, and generate a static fingerprint; Step S212: Establish a malicious fingerprint index by combining the fingerprint feature set formed by segmented hash, rolling hash and static fingerprint, wherein the static fingerprint is used to characterize the overall content features of the payload, and segmented hash and rolling hash are used to improve the ability to identify local variants. Step S213: Perform rule matching and fingerprint index query on the standardized sequence. If a rule is matched, output the rule identifier, label and initial screening confidence. If no rule is matched or the initial screening confidence is lower than the set initial screening threshold, output it as a candidate sample to the semantic understanding layer.

6. The method for generating payload threat intelligence based on multi-stage intelligent perception according to claim 4, characterized in that, Step S22 specifically includes the following steps: Step S221: The standardized sequence of the rule-missing data is segmented into words and sub-words and then input into a DistilBERT-type lightweight encoder. After multi-layer Transformer encoding, segment-level semantic embedding vectors are obtained. Step S222: Construct a directed graph based on the API call sequence, control flow edges and session relationships extracted from multimodal features. Nodes and edges carry type, frequency or entropy features, and graph-level embedding vectors are obtained through information propagation in the graph neural network layer. Step S223: Concatenate the segment-level semantic embedding vector and the graph-level embedding vector, and input them into the classification head to obtain the threat category probability distribution and layer confidence. Step S224: Based on the set dynamic routing mechanism and layer confidence, obtain suspicious samples.

7. The method for generating payload threat intelligence based on multi-stage intelligent perception according to claim 5, characterized in that, Step S23 specifically includes the following steps: Step S231: Input the suspicious sample and multimodal features into the pre-trained large model and encode the prompt context; Step S232: Inject K example question-answer pairs with features similar to the current sample into the prompt context based on the Few-shot example; and retrieve the corresponding entries from the threat intelligence knowledge base based on the RAG fragment using embedding vector retrieval or keyword retrieval and concatenate them into the context; Step S233: Employ a chain-thinking prompt constraint model to output threat assessment, MITRE ATT&CK mapping, IoC and handling suggestions in steps, and then map them into structured intelligence fields through a template parser.

8. A payload threat intelligence generation system based on multi-stage intelligent perception, used to execute the payload threat intelligence generation method based on multi-stage intelligent perception as described in claim 1; characterized in that, It includes a preprocessing and feature extraction unit, a multi-stage progressive detection and analysis unit, and a threat intelligence structured output unit; The preprocessing and feature extraction unit is used to preprocess the acquired raw payload data to be analyzed, decode it to obtain a standardized sequence, and extract multimodal features. The multi-stage progressive detection and analysis unit is used to input standardized sequences into the constructed three-layer detection model to obtain layer confidence and structured intelligence fields; the three-layer detection model includes a fast filtering layer, a semantic understanding layer, and a deep parsing layer; The threat intelligence structured output unit is used to generate a unified analysis fact set based on structured intelligence fields and multimodal features, and output the consistent threat intelligence to the threat intelligence platform.

9. An electronic device, characterized in that, It includes a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements a payload threat intelligence generation method based on multi-stage intelligent perception as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 9, they implement a payload threat intelligence generation method based on multi-stage intelligent perception as described in any one of claims 1-7.

Images