Network attack detection rule updating method, apparatus, device, and storage medium

Abstract

The application discloses a network attack detection rule updating method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: extracting payload content related to network attack detection rule matching from a received network attack sample; calling a large language model to perform semantic association reasoning on the extracted payload content and detection rules in a basic rule library; determining the attack type of the attack sample; using the semantic understanding capability of the large language model to identify the essential association between the attack sample and existing rules from the semantic level, thereby improving the identification capability of variant attacks; calling corresponding rule components according to the attack type to generate multiple candidate rules for updating the basic rule library, including adding rules for new attacks and repairing rules for variant attacks, thereby avoiding redundancy between rules, improving the generalization capability, usability and stability of the detection performance of the rules, and meeting the network security protection requirements in a dynamic network environment.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and storage medium for updating network attack detection rules. Background Technology

[0002] With the increasing frequency of cyberattacks, the requirements for network security defense systems are gradually increasing. Effective and timely detection of cyberattacks is crucial for maintaining network security. Currently, network attack detection systems detect attack behaviors and generate alerts by monitoring network traffic and other relevant data. There are two main types of network attack detection methods: rule-based methods and learning-based methods. Rule-based methods identify attack behaviors through predefined detection rules. Due to their advantages such as high detection accuracy, fast matching speed, and low false positive rate, they are currently the most widely used network security defense method. The detection effectiveness and performance of rule-based network attack detection methods depend primarily on the quality of the rule set used. The network environment is constantly changing, and rule sets are easily outdated and ineffective in the face of newly disclosed vulnerabilities and constantly evolving attack variants.

[0003] Traditional methods relying on manually written and configured detection rules are insufficient for timely responses to new types of attacks and effective defense against attack variants that bypass rules. Automatic detection rule generation solutions mainly fall into three categories: data mining-based, machine learning-based, and heuristic filtering-based. Data mining-based methods generate rules by extracting statistical patterns and surface-level patterns from traffic; machine learning-based methods use trained models to infer attack characteristics and transform them into rules; and heuristic filtering-based methods construct matching conditions to form detection rules through reverse analysis of network attack samples and empirical strategies. However, existing automatic detection rule generation solutions only extract shallow statistical features of traffic or perform literal pattern matching, lacking an understanding of the semantic essence of attacks. They cannot identify the inherent commonalities of variant attacks, resulting in weak generalization ability, unstable detection performance, and an inability to meet the actual detection needs of dynamic network security scenarios.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a method, apparatus, device and storage medium for updating network attack detection rules, which aims to solve the technical problem that existing automatic generation schemes for detection rules lack an understanding of the semantic essence of attacks, resulting in weak generalization ability of generated rules and unstable detection performance, and thus failing to meet the detection needs in dynamic network security scenarios.

[0006] To achieve the above objectives, this application proposes a method for updating network attack detection rules, the method comprising: From the received network attack samples, extract the payload content that matches the network attack detection rules; the payload content includes the request type and request parameters; The large language model is invoked to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; Based on the attack type, the corresponding rule component is invoked to generate multiple candidate rules; the rule component is built based on an intelligent agent. The candidate rules are used to update the basic rule base; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

[0007] In one embodiment, the step of updating the basic rule base using the candidate rules includes: The candidate rules are subjected to multiple verifications to select the optimal rule for network attack detection; the multiple verifications include at least semantic verification and syntax verification. The base rule base is updated using the optimal rule.

[0008] In one embodiment, the step of updating the basic rule base using the optimal rule includes: If the attack type of the network attack sample is a new type of attack, a new entry is created in the basic rule base, and the optimal rule is written into the new entry to update the basic rule base. If the attack type of the network attack sample is a variant attack, then obtain the original entries of the rule to be repaired corresponding to the optimal rule. The original entries are replaced with the optimal rules to update the basic rule base.

[0009] In one embodiment, after the step of replacing the rule to be repaired with the optimal rule on the original entry to update the basic rule base, the method further includes: The association information between the network attack sample and the rule to be repaired is input into the large language model for association analysis, and the association information is updated according to the analysis results of the large language model. The updated association information is then associated and bound with the optimal rule.

[0010] In one embodiment, the rule component includes a rule repair component and a rule generation component; the step of invoking the corresponding rule component according to the attack type to generate multiple candidate rules includes: Key attack information is extracted from the network attack samples; the key attack information includes attack type, attack method, and malicious payload. If the attack type is a variant attack, the rule repair component is invoked to execute the rule repair process and generate multiple candidate rules based on the key attack information; If the attack type is a novel attack, the rule generation component is invoked to execute the rule generation process and generate multiple candidate rules based on the key attack information.

[0011] In one embodiment, the execution rule repair process, the step of generating multiple candidate rules based on the key attack information, includes: Based on the key attack information, the rules to be repaired corresponding to the network attack sample and the association information of the rules to be repaired are obtained from the basic rule base; the association information is used to characterize the attack behavior features of the network attack detected corresponding to the rules to be repaired. The payload content and the associated information are combined into prompt words according to a predefined prompt template and input into the large language model. The large language model is then used to extract the common features in attack logic between the attack behavior detected by the rule to be repaired and the network attack sample. Based on the common characteristics, multiple candidate rules are generated to repair the rule to be repaired in a manner that minimizes the scope of change.

[0012] In one embodiment, the step of invoking a large language model to perform semantic association reasoning on the payload content and detection rules in the basic rule base to determine the attack type corresponding to the network attack sample includes: The large language model is invoked, and the payload content and the detection rules in the basic rule base are combined into prompt words according to the predefined prompt template and input into the large language model. The large language model is used to perform semantic association reasoning on the association information between the payload content and the detection rules. Based on the vulnerability exploitation principle, attack vector structure and malicious payload characteristics, it is determined whether the network attack sample belongs to the attack variant corresponding to the existing rules in the basic rule base. The attack type corresponding to the network attack sample is determined based on the judgment result.

[0013] Furthermore, to achieve the above objectives, this application also proposes a network attack detection rule updating device, which includes: The sample parsing module is used to extract payload content related to matching network attack detection rules from the received network attack samples; the payload content includes request type and request parameters. The semantic reasoning module is used to call a large language model to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; The rule generation module is used to call the corresponding rule component according to the attack type and generate multiple candidate rules; the rule component is built based on an intelligent agent. The rule update module is used to update the basic rule base using the candidate rules; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

[0014] In addition, to achieve the above objectives, this application also proposes a network attack detection rule update device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network attack detection rule update method as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the network attack detection rule update method described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the network attack detection rule update method described above.

[0017] One or more technical solutions proposed in this application have at least the following technical effects: By extracting request types, request parameters, and other payload content strongly correlated with rules from network attack samples, redundant information irrelevant to the detection logic is filtered out, allowing subsequent processing to focus on the core information actually relied upon by the rules. Based on this, a large language model is invoked to perform semantic association reasoning between the payload content and detection rules in the pre-set basic rule base. Utilizing the semantic understanding capabilities of the large language model, the inherent relationship between attack samples and existing rules can be identified at the semantic level, thus distinguishing between variant attacks or new types of attacks. Based on the identified attack type, the corresponding rule component is invoked to generate multiple candidate rules, enabling the generation of detection rules to dynamically adapt to different attack types. This ensures that the detection rules cover the essence of the attack, improves the ability to identify variant attacks, and ensures that the generated rules reflect the essential relationships between different network attack samples. The generated candidate rules are used to update the basic rule base. Updates include adding rules for new types of attacks and repairing rules for variant attacks. Rule repair avoids redundancy among rules in the basic rule base caused by rules generated for variant attacks, while ensuring the generalization ability, usability, and stability of detection performance, which is beneficial for meeting the network security protection needs in dynamic network environments. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating the network attack detection rule update method provided in this application embodiment; Figure 2 One of the schematic diagrams of the network attack detection rule update process provided in the embodiments of this application; Figure 3 The second schematic diagram of the update process of network attack detection rules provided in the embodiments of this application; Figure 4 This is a schematic diagram of the module structure of the network attack detection rule update device according to an embodiment of this application; Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the network attack detection rule update method in this application embodiment.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] For network attack detection, existing automatic rule generation solutions based on data mining, machine learning, and heuristic screening suffer from several drawbacks. Firstly, they lack mechanisms to repair existing rules. During rule generation, they fail to consider the correlation between new network attack samples and existing rules, continuously generating entirely new rules for newly discovered attack samples. This leads to a continuous increase in the number of rules as the number of samples grows, resulting in numerous redundant rules with overlapping functions for attack variants of the same attack type. In practical deployments, this causes a large number of duplicate alerts. Secondly, they fail to perceive the essential characteristics of attack behavior, performing only shallow statistical feature extraction or pattern matching on traffic. When faced with unlabeled or poorly labeled samples, they cannot identify the essential correlations between different variants of the same attack behavior, nor can they pinpoint the malicious fields constituting the core of the attack. This results in insufficient rule generalization ability and degraded detection performance. Finally, existing solutions do not consider continuous rule updates and maintenance, treating rule generation as a one-time task. They lack dynamic updates and long-term maintenance of the rule set, failing to support incremental updates and adaptive evolution of rules, thus failing to meet the actual needs of network security operations.

[0025] Based on this, this application provides a solution for the adaptive generation and repair of network attack detection rules driven by the semantics of a large language model. With the semantic understanding capability of the large language model as the core driving force, it analyzes the correlation between new network attack samples and existing rules, and adaptively allocates update or generation tasks. Based on the analysis of attack behavior, it realizes the automatic generation and repair of rules. At the same time, it combines a multi-level verification mechanism to construct a deployable network attack detection rule set.

[0026] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or network attack detection rule update device capable of performing the above functions. The following description uses a network attack detection rule update device as an example to illustrate this embodiment and the subsequent embodiments.

[0027] Specifically, embodiments of this application provide a method for updating network attack detection rules, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the network attack detection rule update method provided in an embodiment of this application.

[0028] In this embodiment, the network attack detection rule update method includes steps S10 to S40: Step S10: Extract payload content related to matching network attack detection rules from the received network attack sample; the payload content includes request type and request parameters. Step S20: Call the large language model to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; Step S30: Invoke the corresponding rule component according to the attack type to generate multiple candidate rules; the rule component is built based on an intelligent agent; Step S40: Update the basic rule base using the candidate rules; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

[0029] From the received network attack samples, payload content related to matching network attack detection rules is extracted. This payload content includes request type and request parameters. The request type is used to characterize the access method or type of the network attack sample, and the request parameters are the business variables corresponding to the network attack sample, such as user information and user address.

[0030] For a received network attack sample to be processed, after extracting the payload content related to rule matching, the large language model is called to perform semantic association reasoning on the extracted payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample. This attack type includes new attacks and variant attacks corresponding to existing rules.

[0031] It should be noted that the large language model is pre-trained. In one embodiment, the large language model is obtained by domain fine-tuning based on network attack sample data on the basis of pre-training.

[0032] By using semantic association reasoning and leveraging the semantic understanding and reasoning capabilities of large language models, we can determine whether a network attack sample belongs to a variant of a network attack corresponding to an existing rule from the perspective of attack semantics, thereby determining the attack type of the network attack sample.

[0033] Furthermore, based on the attack type of the network attack sample, the corresponding rule component is invoked to generate multiple candidate rules. These rule components are built upon an intelligent agent. In one embodiment, multiple rule components are included, with different rule components corresponding to different attack types. Different rule components generate detection rules as candidate rules using different methods. In another embodiment, only one rule component exists, and the same rule component can generate detection rules as candidate rules using different methods depending on the attack type.

[0034] The generated candidate rules are used to update the basic rule base. Updating the basic rule base can be achieved through at least one of the following methods: adding rules to address new types of attacks and repairing rules to address variant attacks. The basic rule base is either an existing network attack detection rule base or a historical rule base used for network attack detection. For example, when updating the basic rule base using generated candidate rules to address variant attacks, the candidate rules can replace or modify existing rules in the basic rule base, thus repairing existing rules.

[0035] By understanding attacks at the semantic level and generating automated rules driven by intelligent agents, the generalization ability of the generated detection rules can be improved, thereby reducing invalid rules and redundant alarms.

[0036] In this embodiment, by extracting payload content such as request type and request parameters from network attack samples that are strongly correlated with rule matching, redundant information irrelevant to the detection logic in the traffic is filtered out, making it easier for subsequent processing to focus on the core information that the rules actually rely on. Based on this, a large language model is invoked to perform semantic association reasoning between the payload content and detection rules in a preset basic rule base. Utilizing the semantic understanding capabilities of the large language model, the inherent relationship between new samples and existing rules can be identified at the semantic level, thereby distinguishing between variant attacks or new types of attacks. Based on the identified attack type, the corresponding rule component is invoked to generate multiple candidate rules, allowing the generation of detection rules to dynamically adapt to the attack type. This ensures that the detection rules cover the essence of the attack, improves the ability to identify variant attacks, and ensures that the generated rules reflect the essential relationships between different network attack samples. The generated candidate rules are used to update the basic rule base. The update methods include adding rules for new types of attacks and fixing rules for variant attacks. By fixing rules, redundancy between rules in the basic rule base can be avoided, while ensuring the generalization ability, availability and stability of detection performance of the rules. This is conducive to meeting the network security protection needs in dynamic network environments.

[0037] In one embodiment, step S20 may include steps S21-S22: Step S21: Call the large language model, combine the payload content and the detection rules in the basic rule base according to the predefined prompt template into the large language model, and use the large language model to perform semantic association reasoning on the association information between the payload content and the detection rules. Based on the vulnerability exploitation principle, attack vector structure and malicious payload characteristics, determine whether the network attack sample belongs to the attack variant corresponding to the existing rules in the basic rule base. Step S22: Determine the attack type corresponding to the network attack sample based on the judgment result.

[0038] The large language model is invoked, and the extracted payload content and detection rules in the basic rule base are combined into prompt words according to the predefined prompt template and input into the large language model. The large language model is used to perform semantic association reasoning on the information related to the payload content and detection rules. Based on at least one of the vulnerability exploitation principle, attack vector structure and malicious payload characteristics, it is determined whether the network attack sample belongs to the attack variant of the network attack sample corresponding to the existing rules in the basic rule base. The attack type corresponding to the network attack sample is determined according to the determination result.

[0039] The association information of detection rules in the basic rule base specifically refers to the relevant information that can represent typical characteristics of attack behavior, obtained through analysis during the generation or repair of detection rules, including attack category, attack method, and representative samples.

[0040] Attack category indicates the type of security threat to which the network attack sample belongs, while attack method indicates the path, fields, or payload construction method used by the attacker to carry out the attack. The network attack sample is input into a large language model, which drives it to extract the attack category, attack method, and key malicious payload content.

[0041] Furthermore, the payload content of the new network attack sample, along with existing rules and their associated information, is organized into a prompt text according to a predefined prompt template and input into a large language model. Utilizing the semantic understanding capability of the large language model, it is determined from the attack semantic level whether the new network attack sample belongs to a variant of the network attack behavior or attack type corresponding to the existing rules. The judgment criteria include whether the vulnerability exploitation principle is the same, whether the attack vector structure is similar, and whether the core characteristics of the malicious payload are consistent.

[0042] In one embodiment, the invoked rule component includes a rule repair component and a rule generation component. Based on this, step S30 may include steps S31 to S33: Step S31: Extract key attack information from the network attack sample; the key attack information includes attack type, attack method, and malicious payload; Step S32: If the attack type is a variant attack, call the rule repair component, execute the rule repair process, and generate multiple candidate rules based on the key attack information; Step S33: If the attack type is a new type of attack, call the rule generation component to execute the rule generation process and generate multiple candidate rules based on the key attack information.

[0043] If the attack type is a variant attack, the rule repair component is invoked to execute the rule repair process. Based on the extracted key attack information such as attack category, attack method and malicious payload, multiple candidate rules are generated. The optimal rule selected from these candidate rules is used to repair the existing rules.

[0044] If the attack type is a new type of attack, the rule generation component is invoked to execute the rule generation process. Based on the extracted key attack information such as attack category, attack method and malicious payload, multiple candidate rules that conform to the syntax specifications of the network attack detection engine are generated. The optimal rule selected from these candidate rules is the newly generated rule, which is used to detect new types of attacks.

[0045] Understandably, both the rule repair component and the rule generation component are built on the basis of intelligent agents.

[0046] Based on the rule repair and rule generation components, tasks are assigned according to the attack type determination results of the network attack sample. If the network attack sample does not constitute a variant of existing rules, it is considered a new type of attack and is distributed to the rule generation process to generate new detection rules, which are then added to the basic rule base to update the base rule base. If the network attack sample is determined to be a variant of an attack corresponding to an existing rule, the network attack sample, existing rules, and their associated information are distributed to the rule repair component to execute the rule repair process. This generates candidate rules for repairing existing rules, which are then used to repair the existing rules to update the basic rule base. This ensures that the repaired rules, in addition to their original detection capabilities, also cover the detection of variant attacks.

[0047] In one embodiment, refer to Figure 2 The network attack rule generation process shown extracts the payload content related to rule matching from the received network attack samples, and calls a large language model to perform semantic association reasoning on the extracted payload content and the detection rules in the preset basic rule base to determine the attack type corresponding to the network attack sample.

[0048] Key attack information, such as attack category, attack method, and malicious payload, is extracted from the network attack samples. For network attack samples identified as novel attacks, a rule generation component is invoked to initiate a rule generation process, generating multiple candidate rules based on the extracted key attack information. For network attack samples identified as variant attacks, a rule repair component is invoked to initiate a rule repair process, generating multiple repair rules based on the extracted key attack information. Finally, the generated candidate rules undergo multiple verifications to select the optimal rule for network attack detection. This optimal rule is then used to update the basic rule base. For variant attacks, the optimal rule is used to repair existing rules corresponding to the variant attack in the basic rule base, avoiding the generation of redundant rules. For novel attacks, the optimal rule is added to the basic rule base for the detection of novel attacks.

[0049] Based on the attack type analysis and judgment mechanism, the processing path for each network attack sample can be adaptively determined through semantic-level relational reasoning. For variant attacks, the detection of network attacks can be achieved by repairing existing rules, thereby avoiding the generation of redundant rules for variant attacks.

[0050] In the rule generation process, the rule generation component is used to automatically generate corresponding detection rules as candidate rules based on the semantic analysis results for network attack samples that are identified as new types of attacks. These candidate rules are detection rules that conform to the syntax specifications of the network attack detection engine.

[0051] As an example, in the rule generation process, firstly, a large language model is used to extract core information such as attack category, attack method, and key malicious payload from network attack samples. Then, based on the extracted key attack information, multiple candidate rules conforming to the detection engine's syntax specifications are generated.

[0052] For network attack samples identified as attack variants, the rule repair process is initiated, generating multiple candidate rules for rule repair. Based on this, step S32 may further include steps S321-S323: Step S321: Based on the key attack information, match and obtain the rule to be repaired corresponding to the network attack sample from the basic rule base, as well as the association information of the rule to be repaired; the association information is used to characterize the attack behavior features of the network attack detected corresponding to the rule to be repaired. Step S322: Combine the payload content and the associated information into a prompt word according to a predefined prompt template and input it into the large language model. Use the large language model to extract the common features of the attack behavior detected by the rule to be repaired and the network attack sample in terms of attack logic. Step S323: Based on the common features, generate multiple candidate rules for repairing the rule to be repaired in a manner that minimizes the scope of change.

[0053] Based on key attack information extracted from network attack samples, such as attack category, attack method, and malicious payload, the corresponding rules to be repaired for each network attack sample are obtained from the basic rule base, along with the associated information for those rules. The associated information characterizes the attack behavior features of the network attack detected by the rules to be repaired.

[0054] In one embodiment, the association information of each existing rule in the basic rule base is obtained, the extracted key attack information is matched with the association information of each existing rule, and the rule to be repaired corresponding to the network attack sample of the variant attack is determined based on the matching result.

[0055] The payload content of the network attack and the association information of the rule to be repaired are combined into a prompt text according to a predefined prompt template and input into a large language model. The semantic understanding capability of the large language model is used to extract the common features of the attack behavior detected by the rule to be repaired and the network attack sample in terms of attack logic.

[0056] Furthermore, based on the extracted common features, multiple candidate rules are generated to repair the rule to be repaired in a way that minimizes the scope of change.

[0057] As an example, the rule repair process first involves matching key attack information with the association information of existing rules to obtain the rule to be repaired and its association information from the basic rule base. The payload content of the network attack sample is combined with the attack category, attack method, and representative sample from the association information according to a predefined prompt template to form prompt text, which is then input into a large language model. Utilizing the semantic understanding capabilities of the large language model, common features in the attack logic between the network attack sample and the representative sample are extracted. Then, according to the predefined prompt template, the large language model is driven to compare and analyze the differences in matching fields between the network attack sample and the rule to be repaired, generating multiple candidate repair rules in a manner that minimizes the scope of change.

[0058] Candidate rules generated through the rule repair process and rule generation process must undergo multiple verifications, including syntax verification and semantic verification, before they can be used for network attack detection.

[0059] Syntax validation is used to check whether the rule format conforms to the specification and whether it can be deployed directly. Candidate rules that fail validation are directly eliminated.

[0060] Semantic verification varies depending on the process type: For the rule generation process, the test environment verifies whether the candidate rule can correctly trigger alarms for the original network attack sample; for the rule repair process, the candidate rule must be able to correctly trigger alarms for both the representative sample in the associated information and the newly received network attack sample. The dual verification condition ensures that the repaired rule will not lose its ability to detect the original attack.

[0061] In the rule repair component, for samples identified as attack variants, existing rules are adaptively repaired to ensure their detection capabilities cover both the original attack methods and variant attacks. The component retrieves the rules to be repaired and their associated information from the basic rule base. A large language model is used to extract the semantic common features of new network attack samples and representative samples in the associated information. Combined with attack category and attack method descriptions in the associated information, modifications are made to the original rules while retaining their core logic, generating multiple candidate repair schemes. Syntactic verification and semantic verification are performed on each candidate rule for the new network attack samples and representative samples in the associated information. The optimal rule is then selected and output to the basic rule base for updating.

[0062] Based on this, step S40 may include steps S41 to S42: Step S41: Perform multiple verifications on the candidate rules to select the optimal rule for network attack detection; the multiple verifications include at least semantic verification and syntax verification. Step S42: Update the basic rule base using the optimal rule.

[0063] The generated candidate rules undergo multiple verifications to select the optimal rule for network attack detection. These multiple verifications include at least semantic verification and syntactic verification. Semantic verification confirms that the rule accurately matches the attack traffic. For example, it uses standard replay testing or introduces a model to perform reverse semantic interpretation of the rule text to determine if the matched attack intent is consistent with the network attack sample. Syntactic verification checks whether the rule string meets the parsing requirements of the detection engine, such as whether the regular expression syntax is correct.

[0064] Finally, the selected basic rule base is updated. As mentioned above, the update methods for the basic rule base include at least one of rule repair for variant attacks and rule addition for new types of attacks.

[0065] In one embodiment, if the attack type of the network attack sample is a novel attack, the selected optimal rule is added as a new rule to the basic rule base to update the basic rule base; if the attack type of the network attack sample is a variant attack, the selected optimal rule is used to repair the existing rules corresponding to the network attack sample, so that the existing rules can be enhanced to detect variant attacks, thereby completing the update of the basic rule base.

[0066] As an example, in the multiple verification of candidate rules, the verified candidate rules are analyzed by a large language model and optimized based on practicality. The optimal rule is then output to the basic rule base for subsequent network attack detection. If all candidate rules fail verification, the network attack sample is reprocessed or returned to the manual review queue to ensure the grammatical correctness and semantic validity of the generated detection rules.

[0067] Furthermore, the selected optimal rules are used to update the basic rule base, enabling the detection of subsequent attacks corresponding to network attack samples. Specifically, for each selected optimal rule, if the corresponding network attack sample represents a novel attack type, the optimal rule is added as a new rule to the basic rule base to update it. If the corresponding network attack sample represents a variant attack, the optimal rule is used to replace existing rules to update the basic rule base.

[0068] It should be noted that, for variant attacks, the selected optimal rule has both the detection capability of existing rules and the detection capability of variant attacks on newly received network attack samples.

[0069] That is, the basic rule base is updated using the selected optimal rules. Specifically, this involves adding or replacing existing detection rules in the basic rule base. Updating the basic rule base is achieved by adding or replacing entries. Therefore, step S42 may also include steps S421-S423: Step S421: If the attack type of the network attack sample is a new type of attack, then create a new entry in the basic rule base and write the optimal rule into the new entry to update the basic rule base. Step S422: If the attack type of the network attack sample is a variant attack, then obtain the original entries of the rule to be repaired corresponding to the optimal rule. Step S423: Replace the rule to be repaired with the optimal rule on the original entry to update the basic rule base.

[0070] If the attack type of the network attack sample is a new type of attack, a new entry is created in the basic rule base, and the selected optimal rule is written into the new entry to update the basic rule base.

[0071] If the attack type of the network attack sample is a variant attack, then obtain the original entry of the rule to be repaired corresponding to the optimal rule, and replace the rule to be repaired with the optimal rule on the original entry to update the basic rule base.

[0072] In one embodiment, after step S423, steps S424-S425 may also be included: Step S424: Input the association information between the network attack sample and the rule to be repaired into the large language model for association analysis, and update the association information according to the analysis results of the large language model; Step S425: Associate and bind the updated association information with the optimal rule.

[0073] It should be noted that each detection rule in the basic rule base consists of two parts: the rule content and its associated information. The associated information includes the attack category, the description of the attack method, and a representative sample.

[0074] Furthermore, for the repair rules generated through the rule repair process, the original entries to be updated are located, and the fields corresponding to the original rule content are replaced with the repaired rule content. Simultaneously, newly received variant attack samples and existing association information are submitted to the large language model, which re-analyzes and updates the association information by combining the old and new samples. The updated association information is then linked and bound to the original entries after the rule content is replaced, thus achieving the association binding between association information and repair rules. This process repairs the rules to be repaired and completes the update of the basic rule base.

[0075] Understandably, for new rules generated through the rule generation process, a new entry is created, the rule content of the candidate rule is filled into the field corresponding to the new entry, and then written into the basic rule base. The extracted key attack information is used as the association information of the new rule and associated with the new rule to complete the update of the basic rule base.

[0076] Understandably, when generating repair rules, the rule repair component extracts key attack information from network attack samples. The rule to be repaired can be located using this key attack information. Furthermore, the association information between the network attack sample and the rule to be repaired can be input into a large language model. Utilizing the semantic understanding capabilities of the large language model, the key attack information of the network attack sample can be extracted, and semantic association analysis can be performed between it and the association information of the rule to be repaired. Based on the analysis results of the large language model, the association information is updated and associated with the repair rule after the rule content is replaced.

[0077] Accordingly, for network samples of new types of attacks, when rules are added to the database, key attack information extracted during rule generation will be associated and bound with the rules added to the database as their associated information.

[0078] A rule storage and update mechanism centered on association information is adopted. The large language model continuously updates association information, including attack categories, attack method descriptions, and representative samples, during rule addition and updates, enabling the basic rule base to adapt and evolve. Through this rule management and update mechanism, the basic rule base not only achieves incremental accumulation and version iteration of rules, but also ensures that the association information of each rule always retains the ability to characterize the latest features of that attack type, providing a high-quality reference for subsequent sample category analysis and judgment.

[0079] It should be noted that all rules in the basic rule base can be exported at any time to form a detection rule set that can be directly deployed in the network attack detection system. At the same time, the basic rule base can be verified periodically, and invalid representative samples and obsolete rules can be automatically updated to maintain the detection effectiveness and simplicity of the basic rule base and enable it to have adaptive evolution capabilities.

[0080] It should be further explained that the generated candidate rules also include rule content and its associated information. This associated information is generated based on key attack information extracted from network attack samples. The key attack information extracted from network attack samples includes attack category, attack method, and malicious payload. The malicious payload is the payload content related to matching network attack detection rules. In other words, the key attack information extracted from network attack samples includes payload content related to matching network attack detection rules.

[0081] In some embodiments, key attack information is extracted from the received network attack sample. This key attack information includes the attack type, attack method, and payload content related to matching network attack detection rules. A large language model is invoked to perform semantic association reasoning on the payload content in the key attack information and the detection rules in the basic rule base to determine whether the attack type corresponding to the network attack sample is a new type of attack or a variant attack.

[0082] In one embodiment, refer to Figure 3The illustrated process for generating network attack detection rules involves several steps. First, receiving and parsing new network attack samples, extracting their payload content, and retrieving existing rules and their associated information from the basic rule base. Then, a large language model is invoked. The existing rules, their associated information, and the extracted payload content are combined according to a predefined prompt template to form prompt text, which is then input into the large language model. Utilizing the semantic understanding capabilities of the large language model, semantic association reasoning is performed on the payload content, existing rules, and their associated information to obtain the essential association between the network attack sample and existing rules at the semantic level, thereby determining the attack type of the network attack sample.

[0083] Key attack information is extracted from network attack samples. If a network attack sample is identified as a new type of attack, it is distributed to the rule generation component, which is then invoked to execute the rule generation process. The key attack information of the network attack sample is extracted using a large language model, and multiple candidate detection rules are generated.

[0084] If a network attack sample is determined to be a variant attack, the network attack sample is distributed to the rule repair component, which is then invoked to execute the rule repair process, extract the common features between the network attack sample and the rule to be repaired, and generate multiple candidate repair rules.

[0085] For the generated candidate detection rules or candidate remediation rules, perform syntactic validation to determine if any candidate rules pass the validation. If not, the rules are returned to the manual review queue for manual review. If any candidate rules pass the syntactic validation, perform semantic validation to determine if any candidate rules pass the semantic validation. If not, the rules are also returned to the manual review queue for manual review. If any candidate rules pass the semantic validation, create a new entry or locate an existing entry in the database and update the rule content and its associated information. Export a set of detection rules that can be directly deployed from the database for deployment applications of network attack detection. Regularly update the invalid representative samples in the associated information and mark obsolete rules.

[0086] In this embodiment, the semantic understanding capability of the large language model is combined with the automated execution of the agent. On the one hand, the scale of the rule set is effectively controlled by the fine-grained discrimination of attack types and the differentiated generation or repair strategies, which alleviates the problems of redundancy and duplicate alarms among rules. On the other hand, through multiple verifications and continuous updates of metadata, it is ensured that the generated rules can be directly deployed and applied, and that the ability to detect constantly evolving attack variants is maintained in the long term.

[0087] During rule generation, an attack sample category analysis and judgment mechanism based on semantic relation reasoning using a large language model is employed. This mechanism retrieves association information from existing rules in the basic rule base and uses the large language model to determine the association between new samples and existing rules, adaptively distributing rule generation or repair tasks. Combining multiple verification mechanisms, including syntactic and semantic verification, rule repair for attack variants requires triggering alarms for both representative and new samples during semantic verification. This ensures that the repaired rules do not lose the ability to detect the original attack while simultaneously covering the detection capability for variant attacks.

[0088] In the rule management and update mechanism, the core is the association information. The large language model continuously updates the association information, including attack categories, attack method descriptions and representative samples, when rules are added to the database and updated. This enables the basic rule base to have adaptive evolution capabilities and maintain the detection effect and simplicity of the basic rule base.

[0089] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the network attack detection rule update method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0090] This application also provides a network attack detection rule update device, please refer to... Figure 4 The network attack detection rule update device includes: The sample parsing module 10 is used to extract payload content related to matching network attack detection rules from the received network attack samples; the payload content includes request type and request parameters. The semantic reasoning module 20 is used to call a large language model to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; The rule generation module 30 is used to call the corresponding rule component according to the attack type to generate multiple candidate rules; the rule component is built based on an intelligent agent. The rule update module 40 is used to update the basic rule base using the candidate rules; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

[0091] In one embodiment, the rule update module 40 is further configured to: The candidate rules are subjected to multiple verifications to select the optimal rule for network attack detection; the multiple verifications include at least semantic verification and syntax verification. The base rule base is updated using the optimal rule.

[0092] In one embodiment, the rule update module 40 is further configured to: If the attack type of the network attack sample is a new type of attack, a new entry is created in the basic rule base, and the optimal rule is written into the new entry to update the basic rule base. If the attack type of the network attack sample is a variant attack, then obtain the original entries of the rule to be repaired corresponding to the optimal rule. The original entries are replaced with the optimal rules to update the basic rule base.

[0093] In one embodiment, the rule update module 40 is further configured to: The association information between the network attack sample and the rule to be repaired is input into the large language model for association analysis, and the association information is updated according to the analysis results of the large language model. The updated association information is then associated and bound with the optimal rule.

[0094] In one embodiment, the rule component includes a rule repair component and a rule generation component; the rule generation module 30 is further configured to: Key attack information is extracted from the network attack samples; the key attack information includes attack type, attack method, and malicious payload. If the attack type is a variant attack, the rule repair component is invoked to execute the rule repair process and generate multiple candidate rules based on the key attack information; If the attack type is a novel attack, the rule generation component is invoked to execute the rule generation process and generate multiple candidate rules based on the key attack information.

[0095] In one embodiment, the rule generation module 30 is further configured to: Based on the key attack information, the rules to be repaired corresponding to the network attack sample and the association information of the rules to be repaired are obtained from the basic rule base; the association information is used to characterize the attack behavior features of the network attack detected corresponding to the rules to be repaired. The payload content and the associated information are combined into prompt words according to a predefined prompt template and input into the large language model. The large language model is then used to extract the common features in attack logic between the attack behavior detected by the rule to be repaired and the network attack sample. Based on the common characteristics, multiple candidate rules are generated to repair the rule to be repaired in a manner that minimizes the scope of change.

[0096] In one embodiment, the semantic reasoning module 20 is further configured to: The large language model is invoked, and the payload content and the detection rules in the basic rule base are combined into prompt words according to the predefined prompt template and input into the large language model. The large language model is used to perform semantic association reasoning on the association information between the payload content and the detection rules. Based on the vulnerability exploitation principle, attack vector structure and malicious payload characteristics, it is determined whether the network attack sample belongs to the attack variant corresponding to the existing rules in the basic rule base. The attack type corresponding to the network attack sample is determined based on the judgment result.

[0097] The network attack detection rule updating device provided in this application, employing the network attack detection rule updating method described in the above embodiments, can solve the technical problem that existing automatic generation schemes for detection rules lack an understanding of the semantic essence of attacks, resulting in weak generalization ability of the generated rules and unstable detection performance, failing to meet the detection needs in dynamic network security scenarios. Compared with the prior art, the beneficial effects of the network attack detection rule updating device provided in this application are the same as those of the network attack detection rule updating method provided in the above embodiments, and other technical features in the network attack detection rule updating device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0098] This application provides a network attack detection rule update device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the network attack detection rule update method in the first embodiment described above.

[0099] The following is for reference. Figure 5 The diagram illustrates a structural schematic suitable for implementing a network attack detection rule update device according to embodiments of this application. The network attack detection rule update device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The network attack detection rule update device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0100] like Figure 5As shown, the network attack detection rule update device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the network attack detection rule update device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the network attack detection rule update device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows network attack detection rule update devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0101] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0102] The network attack detection rule update device provided in this application, employing the network attack detection rule update method described in the above embodiments, can solve the technical problem that existing automatic generation schemes for detection rules lack an understanding of the semantic essence of attacks, resulting in weak generalization ability of the generated rules and unstable detection performance, failing to meet the detection needs in dynamic network security scenarios. Compared with the prior art, the beneficial effects of the network attack detection rule update device provided in this application are the same as those of the network attack detection rule update method provided in the above embodiments, and other technical features in this network attack detection rule update device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0103] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0105] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the network attack detection rule update method in the above embodiments.

[0106] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0107] The aforementioned computer-readable storage medium may be included in the network attack detection rule update device; or it may exist independently and not be assembled into the network attack detection rule update device.

[0108] The aforementioned computer-readable storage medium carries one or more programs that, when executed by the network attack detection rule updating device, cause the network attack detection rule updating device to: From the received network attack samples, extract the payload content that matches the network attack detection rules; the payload content includes the request type and request parameters; The large language model is invoked to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; Based on the attack type, the corresponding rule component is invoked to generate multiple candidate rules; the rule component is built based on an intelligent agent. The candidate rules are used to update the basic rule base; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

[0109] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0110] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0111] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0112] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described network attack detection rule update method. This addresses the technical problem that existing automatic rule generation schemes lack an understanding of the semantic essence of attacks, resulting in weak generalization ability of the generated rules and unstable detection performance, failing to meet the detection needs of dynamic network security scenarios. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the network attack detection rule update method provided in the above embodiments, and will not be repeated here.

[0113] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network attack detection rule update method described above.

[0114] The computer program product provided in this application solves the technical problem that existing automatic detection rule generation schemes lack an understanding of the semantic essence of attacks, resulting in weak generalization ability of the generated rules and unstable detection performance, failing to meet the detection needs in dynamic network security scenarios. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the network attack detection rule update method provided in the above embodiments, and will not be repeated here.

[0115] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for updating network attack detection rules, characterized in that, The method for updating network attack detection rules includes: From the received network attack samples, extract the payload content that matches the network attack detection rules; the payload content includes the request type and request parameters; The large language model is invoked to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; Based on the attack type, the corresponding rule component is invoked to generate multiple candidate rules; the rule component is built based on an intelligent agent. The candidate rules are used to update the basic rule base; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

2. The network attack detection rule update method as described in claim 1, characterized in that, The step of updating the basic rule base using the candidate rules includes: The candidate rules are subjected to multiple verifications to select the optimal rule for network attack detection; the multiple verifications include at least semantic verification and syntax verification. The base rule base is updated using the optimal rule.

3. The network attack detection rule update method as described in claim 2, characterized in that, The step of updating the basic rule base using the optimal rule includes: If the attack type of the network attack sample is a new type of attack, a new entry is created in the basic rule base, and the optimal rule is written into the new entry to update the basic rule base. If the attack type of the network attack sample is a variant attack, then obtain the original entries of the rule to be repaired corresponding to the optimal rule. The original entries are replaced with the optimal rules to update the basic rule base.

4. The network attack detection rule update method as described in claim 3, characterized in that, After the step of replacing the rule to be repaired with the optimal rule on the original entry to update the basic rule base, the method further includes: The association information between the network attack sample and the rule to be repaired is input into the large language model for association analysis, and the association information is updated according to the analysis results of the large language model. The updated association information is then associated and bound with the optimal rule.

5. The network attack detection rule update method as described in claim 1, characterized in that, The rule component includes a rule repair component and a rule generation component; the step of calling the corresponding rule component according to the attack type to generate multiple candidate rules includes: Key attack information is extracted from the network attack samples; the key attack information includes attack type, attack method, and malicious payload. If the attack type is a variant attack, the rule repair component is invoked to execute the rule repair process and generate multiple candidate rules based on the key attack information; If the attack type is a novel attack, the rule generation component is invoked to execute the rule generation process and generate multiple candidate rules based on the key attack information.

6. The network attack detection rule update method as described in claim 5, characterized in that, The execution rule repair process, which generates multiple candidate rules based on the key attack information, includes the following steps: Based on the key attack information, the rules to be repaired corresponding to the network attack sample and the association information of the rules to be repaired are obtained from the basic rule base; the association information is used to characterize the attack behavior features of the network attack detected corresponding to the rules to be repaired. The payload content and the associated information are combined into prompt words according to a predefined prompt template and input into the large language model. The large language model is then used to extract the common features in attack logic between the attack behavior detected by the rule to be repaired and the network attack sample. Based on the common characteristics, multiple candidate rules are generated to repair the rule to be repaired in a manner that minimizes the scope of change.

7. The network attack detection rule update method as described in claim 1, characterized in that, The step of calling a large language model to perform semantic association reasoning on the payload content and detection rules in the basic rule base to determine the attack type corresponding to the network attack sample includes: The large language model is invoked, and the payload content and the detection rules in the basic rule base are combined into prompt words according to the predefined prompt template and input into the large language model. The large language model is used to perform semantic association reasoning on the association information between the payload content and the detection rules. Based on the vulnerability exploitation principle, attack vector structure and malicious payload characteristics, it is determined whether the network attack sample belongs to the attack variant corresponding to the existing rules in the basic rule base. The attack type corresponding to the network attack sample is determined based on the judgment result.

8. A network attack detection rule updating device, characterized in that, The network attack detection rule update device includes: The sample parsing module is used to extract payload content related to matching network attack detection rules from the received network attack samples; the payload content includes request type and request parameters. The semantic reasoning module is used to call a large language model to perform semantic association reasoning on the payload content and the detection rules in the basic rule base to determine the attack type corresponding to the network attack sample; the attack type includes new attacks and variant attacks of existing rules; The rule generation module is used to call the corresponding rule component according to the attack type and generate multiple candidate rules; the rule component is built based on an intelligent agent. The rule update module is used to update the basic rule base using the candidate rules; the update includes at least one of adding rules for the new type of attack and fixing rules for the variant attack.

9. A network attack detection rule update device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network attack detection rule update method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the network attack detection rule update method as described in any one of claims 1 to 7.

Images