An intent understanding-based power grid malicious code attack chain analysis method and system

Abstract

This invention relates to the field of network security technology, and in particular to a method and system for parsing malicious code attack chains in power grids based on intent understanding. The method constructs a three-layer knowledge graph using micro-behavioral nodes, technical means nodes, and macro-tactical nodes as graph nodes to obtain ternary association paths, generates graph node structural features and standardized instruction pairs, and then obtains a fused input tensor. Based on all fused input tensors, a pre-constructed large language base model is semantically trained to obtain a basic fine-tuning model. A malicious intent recognition head is constructed and connected to the basic fine-tuning model to obtain a fine-tuning model to be trained. A joint loss function and causal prompt word template are constructed, and the fine-tuning model to be trained is then trained based on the joint loss function and causal prompt word template to obtain a malicious code intent recognition model. Finally, the malicious code intent recognition model is used to parse the execution logs of the malicious code under test to obtain the malicious code attack chain.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for parsing malicious code attack chains in power grids based on intent understanding. Background Technology

[0002] With the advancement of smart grid digitalization, persistent threats (APTs) and new types of malicious code attacks targeting power grid control systems are becoming increasingly rampant. These malicious code attacks typically exhibit multi-stage and highly covert characteristics. To address this issue, related fields have begun to introduce graph computing and large language models (LLM) for malicious behavior analysis and attack chain tracing to prevent such malicious code attacks.

[0003] However, existing security knowledge graphs struggle to extract the causal sequence between persistent malicious code. Traditional provenance graphs or security knowledge graphs often employ a flat attribute graph structure, mixing all micro-entities such as files, processes, and network communications together. This structure makes it difficult to quantify the hierarchical evolution relationship between the underlying micro-behavior of malicious code and macro-tactical intentions, resulting in loosely logical attack chains and even fallacies of reversed chronology.

[0004] Similarly, most existing large language models forcibly convert system logs into text prompts using predefined rules, lacking constraints on the physical laws governing attack and defense against malicious code. They also struggle to extract the causal sequence between persistent malicious code, making inference results prone to logical jumps and ignoring the tactical evolution of malicious code in network attack and defense. This leads to models generating analytical results that deviate from actual physical laws of attack and defense when inferring complex, long-sequence attacks, reducing the accuracy of security analysis reports. Summary of the Invention

[0005] This invention aims to provide a method and system for parsing malicious code attack chains in power grids based on intent understanding, in order to solve the technical problems of existing technologies that make it difficult to extract the causal sequence between persistent malicious codes and to identify or understand the tactical evolution logic or hierarchical evolution relationship of malicious codes in network attack and defense, thereby improving the accuracy of malicious code attack chain parsing results.

[0006] To achieve the above objectives, the first aspect of the present invention provides a method for parsing power grid malicious code attack chains based on intent understanding, comprising the following steps: Based on a pre-set network attack knowledge base, micro-behavioral nodes, technical means nodes, and macro-tactical nodes are obtained, and then a three-layer knowledge graph is constructed using the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes as graph nodes. Based on the three-layer knowledge graph, obtain ternary association paths, generate graph node structure features and standardized instruction pairs corresponding to each ternary association path, and then obtain the fusion input tensor of each ternary association path based on the corresponding graph node structure features and standardized instruction pairs. Based on all the aforementioned fused input tensors, semantic training is performed on the pre-constructed large language base model to obtain the basic fine-tuning model; A malicious intent identification head is constructed and connected to the basic fine-tuning model to obtain the fine-tuning model to be trained; A joint loss function and a causal prompt word template are constructed, and then the fine-tuned model to be trained is trained based on the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model; The execution logs of the malicious code to be tested are obtained, and then the execution logs of the malicious code to be tested are analyzed based on the malicious code intent recognition model to obtain the malicious code attack chain.

[0007] The aforementioned method for analyzing power grid malware attack chains based on intent understanding deconstructs the low-level micro-operations, mid-level attack techniques, and high-level tactical objectives of a malware attack process into a hierarchical structure. It constructs a three-layer knowledge graph using micro-behavioral nodes, technical means nodes, and macro-tactical nodes as hierarchical graph nodes. This hierarchical knowledge graph architecture breaks away from the limitations of traditional flat tracing graphs where all entities are mixed together. By distinguishing between micro-behavioral nodes, technical means nodes, and macro-tactical nodes, the three-layer knowledge graph can quantify the tactical evolution logic and hierarchical relationships from the specific micro-behaviors of the low-level malware to the mid-level technical means, and from the mid-level technical means to the high-level macro-tactical intent. This provides a data foundation for subsequently understanding the causal sequence between persistent malware and generating attack chains.

[0008] Then, this invention extracts the complete causal chain from micro-behavioral nodes to technical means nodes and from technical means nodes to macro-tactical nodes from the ternary association paths extracted from the three-layer knowledge graph. For the graph node structural features generated for each ternary association path, the topological dependency and temporal context of the path in its local subgraph are captured; simultaneously, the generated standardized instruction pairs translate attack behaviors into controlled text descriptions containing attack and defense physical laws, providing a unified supervision signal for subsequent model training. By obtaining the fused input tensor of each ternary association path corresponding to the graph node structural features and the standardized instruction pairs, semantic training is performed based on all fused input tensors, enabling the large language foundation model to initially establish the mapping capability from low-level micro-behavior to mid-level technology and high-level tactics, completing basic attack and defense semantic adaptation. Subsequently, a specially constructed malicious intent recognition head is connected to this basic fine-tuning model, mapping the abstract semantic vector output by the model to specific macro-tactical classification results, resulting in a fine-tuning model to be trained that can classify malicious code behavior.

[0009] During the training phase, causal cue word templates are introduced to provide causal guidance for model inference, preventing the model from engaging in illogical reasoning. Under the joint supervision of the joint loss function and the causal cue word templates, the model is fine-tuned, driving it not only to accurately identify malicious intent at each stage but also to learn the inherent temporal relationship of the tactical progression of malicious code under the physical laws of attack and defense. This enables the final malicious code intent recognition model to reconstruct a logically rigorous and temporally correct complete malicious code attack chain when parsing the execution logs of the malicious code under test, thereby solving the problems of inverted attack chain temporal order and loose logic in existing technologies and significantly improving the accuracy of attack chain parsing results.

[0010] Furthermore, the step of acquiring micro-behavioral nodes, technical means nodes, and macro-tactical nodes based on a preset network attack knowledge base, and then constructing a three-layer knowledge graph using the micro-behavioral nodes, technical means nodes, and macro-tactical nodes as graph nodes, includes: Based on a pre-defined network attack knowledge base, obtain a set of micro-behavioral nodes, a set of technical means nodes, and a set of macro-tactical nodes; Based on the network attack knowledge base, a cross-layer mapping edge pointing to the corresponding technical means node is established for each micro-behavior node in the set of micro-behavior nodes; Based on the network attack knowledge base, a cross-layer mapping edge pointing to the corresponding macro-tactical node is established for each of the technical means nodes in the set of technical means nodes; The three-layer knowledge graph is constructed using all the micro-behavioral nodes, all the technical means nodes, and all the macro-tactical nodes as graph nodes, and all the cross-layer mapping edges as graph edges.

[0011] In this implementation, a set of micro-behavioral nodes, a set of technical means nodes, and a set of macro-tactical nodes are extracted from a pre-defined network attack knowledge base. Malicious attack elements are hierarchically categorized according to a standardized attack and defense knowledge system. Then, a cross-layer mapping edge is established for each micro-behavioral node pointing to its corresponding technical means node, and simultaneously, a cross-layer mapping edge is established for each technical means node pointing to its corresponding macro-tactical node. This establishes the tactical evolution logic and hierarchical evolution relationship, from the specific micro-behavioral behavior of the underlying malicious code to the mid-level technical means, and from the mid-level technical means to the high-level macro-tactical intent. This three-layer knowledge graph construction method eliminates the defects of fuzzy causal relationships and reversed time sequences caused by the mixing of underlying entities and high-level intents in existing source graphs. It provides a well-structured and clearly defined hierarchical graph data foundation for subsequently extracting ternary association paths from the graph and generating fusion input tensors with attack and defense physical constraints. This significantly improves the accuracy of identifying and connecting tactical evolution logic during malicious code attack chain analysis.

[0012] Further, the step of obtaining ternary association paths based on the three-layer knowledge graph and generating graph node structural features and standardized instruction pairs corresponding to each ternary association path includes: Determine the set of neighbor nodes for each graph node, and then perform feature aggregation on each graph node based on the corresponding set of neighbor nodes to obtain the graph node structure features of each graph node; For any given micro-behavioral node, determine the technical means node that the micro-behavioral node points to, and determine the macro-tactical node that the technical means node points to, and then generate a ternary association path based on the micro-behavioral node, the technical means node, and the macro-tactical node. For any of the three-element association paths, the graph node structure features corresponding to the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes are taken as the graph node structure features of the three-element association path. For any of the three-ary association paths, a corresponding standardized instruction pair is generated based on a preset natural language template.

[0013] In this implementation, for each graph node in the three-layer knowledge graph, its set of neighboring nodes is first determined, and feature aggregation is performed on the graph node based on this set of neighboring nodes. This ensures that the high-dimensional graph node structural features obtained for each graph node not only encode the node's own attribute semantics but also integrate the topological context and relationships within its local subgraph. Based on this, starting from any micro-behavioral node, along the established cross-layer mapping edge, the technical means node pointed to by the micro-behavioral node and the macro-tactical node pointed to by the technical means node are determined sequentially. These three graph nodes belonging to different semantic levels are then linked together to generate a ternary association path. This path binds the specific low-level operations, the mid-level attack techniques employed, and the attacker's ultimate high-level tactical intent in the attack event into a complete causal unit, explicitly extracting an attack semantic chain with clear temporal dependencies and logical progression relationships from the graph.

[0014] For any generated ternary association path, the graph node structure features of its corresponding micro-behavioral nodes, technical means nodes, and macro-tactical nodes are collectively used as the graph node structure features of that ternary association path. Simultaneously, based on a preset natural language template, standardized instruction pairs are generated for each ternary association path, translating the structured graph path into a controlled natural language description. These standardized instruction pairs, with a unified sentence structure, regulate the physical laws of attack and defense and the logic of tactical evolution, providing semantically regular and temporally clear textual supervision signals for subsequently injecting graph structure data into a large language model.

[0015] Through the above method, each ternary association path extracted from the three-layer knowledge graph simultaneously possesses structured graph node structural features and semantically standardized instruction pairs. These two modalities of data mutually corroborate and constrain each other. When input into a large language model for training, they jointly force the model to adhere to the hierarchical progression and causal temporal relationship in both the feature space and semantic space, where malicious code maps from micro-level behavior to technical means, and from technical means to macro-level tactical intentions in network attack and defense. This helps overcome the shortcomings of existing methods, such as loose logic or reversed temporal order in large model attack chain parsing due to feature flattening and arbitrary text prompts.

[0016] Further, the step of obtaining the fusion input tensor for each of the ternary association paths based on the corresponding graph node structural features and the normalization instructions includes: Construct the perceptron function and the alignment loss function; For any of the given ternary association paths: Obtain the semantic vector of the behavior node corresponding to the micro-behavioral node, the semantic vector of the technical node corresponding to the technical means node, and the semantic vector of the tactical node corresponding to the macro-tactical node; Based on the semantic vector of the behavior node, the graph node structure features corresponding to the micro-behavioral node are mapped to the corresponding continuous soft cue vector through the perceptron function and the alignment loss function; Based on the semantic vector of the technology node, the graph node structure features corresponding to the technology node are mapped into corresponding continuous soft cue vectors through the perceptron function and the alignment loss function; Based on the tactical node semantic vector, the graph node structure features corresponding to the macro tactical node are mapped to the corresponding continuous soft cue vector through the perceptron function and the alignment loss function; Obtain the word embedding vector corresponding to the standardized instruction pair; The continuous soft cue vectors corresponding to the micro-behavioral nodes, the continuous soft cue vectors corresponding to the technical means nodes, the continuous soft cue vectors corresponding to the macro-tactical nodes, and the word embedding vectors are concatenated to obtain the fusion input tensor of the ternary association path.

[0017] In this implementation, a perceptron function and an alignment loss function are constructed. The perceptron function projects the structural features of the knowledge graph nodes onto the semantic dimension space of the large language model. The alignment loss function uses the semantic vectors of the corresponding node's behavioral node, technical node, and tactical node as supervision signals to constrain the perceptron function to align the knowledge graph structural information with the corresponding text semantic information during the mapping process. This achieves accurate alignment between the knowledge graph semantics and the large model semantics, ensuring that the topological dependencies and causal constraints of attack and defense contained in the three-layer knowledge graph are not diluted or distorted during the modality conversion process, but are fully encoded into continuous soft cue vectors.

[0018] For any ternary association path, the graph node structure features of its micro-behavioral nodes, technical means nodes, and macro-tactical nodes are taken as input. Through the synergistic effect of the perceptron function and the alignment loss function, the graph node structure features of the above three levels are mapped one by one into corresponding continuous soft cue vectors. Since the structural features of each graph node have been fused with the topological context of the local subgraph through neighbor aggregation during generation, the continuous soft cue vectors obtained after perceptron mapping carry the structured dependencies of the node in its respective attack chain segment when entering the semantic space of the large language model. This allows the model to directly perceive the structured constraints between behavioral nodes and technical nodes, and between technical nodes and tactical nodes, from continuous vector signals. At the same time, the word embedding vectors of the standardized instruction pairs are obtained. These word embedding vectors accurately describe the attack semantics and tactical evolution logic represented by the ternary association path in text form.

[0019] Subsequently, the continuous soft cue vectors of micro-behavioral nodes, technical means nodes, and macro-tactical nodes, along with the word embedding vectors of standardized instruction pairs, are sequentially concatenated to form the fusion input tensor of this ternary association path. This allows the large language model to receive this fusion input tensor, where the front-end continuous soft cue vectors pre-lay strict physical constraints of attack and defense and temporal causal constraints in the semantic space for subsequent text semantic reasoning. This prevents the model from generating jumpy inferences that deviate from actual attack logic during autoregressive generation. This method of constructing the fusion input tensor effectively bridges the alignment bias and information loss caused by the separation and independent encoding of graph structure data and natural language cue words in existing technologies. This allows the invention to combine the capabilities of hierarchical knowledge graphs and large language models to understand the intent of malicious code and construct attack chains, thereby improving the accuracy of malicious code attack chain parsing results in terms of causal temporal and tactical logic.

[0020] Furthermore, the semantic training of the pre-constructed large language foundation model based on all the fused input tensors to obtain the basic fine-tuning model includes: Freeze the main intervention training parameters of the large language base model and introduce a low-rank matrix into the large language base model; Construct a forward propagation function based on the main intervention training parameters, the low-rank matrix, and all the fused input tensors; Based on the forward propagation function, the large language base model is semantically trained to obtain a basic fine-tuning model.

[0021] In this implementation, by freezing the main intervention training parameters of the large language base model, the general semantic understanding, logical reasoning, and language generation capabilities accumulated during the pre-training phase are fully preserved. This avoids the model forgetting problem that may occur due to full parameter fine-tuning, ensuring that the model still possesses robust language foundation capabilities when facing specialized domain tasks such as power grid malicious code attacks. Based on this, a low-rank matrix is ​​introduced into the large language base model to approximate the parameter update amount through low-rank decomposition. This allows the model to adapt to the downstream task of malicious code attack chain parsing by adjusting a very small proportion of additional parameters without significantly increasing the number of trainable parameters or computational overhead. Then, based on the frozen main intervention training parameters, the introduced low-rank matrix, and all fused input tensors, a forward propagation function is constructed. Graph structure information and attack semantic information are injected into the model's forward computation process via the fused input tensor. Gradient updates are performed only on the low-rank matrix portion, enabling the model to initially establish a mapping capability from low-level micro-behavior to mid-level technology and high-level tactics, completing basic offensive and defensive semantic adaptation. This design ensures that the model training process is highly sensitive to the causal timing of the attack chain, while maintaining the semantic generalization of the pre-trained base model.

[0022] Further, the step of constructing a malicious intent identification head and connecting the malicious intent identification head to the basic fine-tuning model to obtain the fine-tuning model to be trained includes: A first fully connected layer is constructed, and a non-linear activation layer is constructed on top of the first fully connected layer. A second fully connected layer is then constructed on top of the non-linear activation layer, and a normalization layer is constructed on top of the second fully connected layer to form the malicious intent identification head. Obtain the sequence latent feature vector output by the basic fine-tuning model; The hidden feature vectors of the sequence are connected to the first fully connected layer to obtain the fine-tuned model to be trained.

[0023] In this implementation, a malicious intent detection head is constructed by sequentially stacking a first fully connected layer, a nonlinear activation layer, a second fully connected layer, and a normalization layer. This allows the model's abstract semantic vectors to be mapped to specific macro-tactical classification results. The first fully connected layer performs preliminary dimensionality transformation and feature reorganization on the input semantic features. The nonlinear activation layer, located between the two fully connected layers, introduces nonlinear expressive power into the detection head, enabling this sub-network to fit the complex decision boundaries between the implicit semantics of the attack sequence and the high-dimensional intent category space, rather than simply learning simple linearly separable patterns. The second fully connected layer further maps the nonlinearly activated features to the intent category dimension, and then the normalization layer transforms the output into a standardized intent category probability distribution.

[0024] The sequence latent feature vector output by the basic fine-tuning model is obtained and directly fed into the first fully connected layer, thus obtaining the fine-tuning model to be trained. Since the basic fine-tuning model has already internalized the hierarchical attack and defense rules and causal temporal dependencies from micro-behavior to technical means, and from technical means to macro-tactical intentions, through deep integration of input tensors during the early semantic training phase, its output sequence latent feature vector is rich in tactical progressive semantics and structured constraint information between successive steps in the attack chain. Feeding this high-quality feature vector directly into the malicious intent identification head is equivalent to enabling the identification head to fully utilize the full sequence context and inter-layer causal relationships accumulated by the basic fine-tuning model when classifying the macro-intent of each attack step, thereby obtaining the macro-tactical intent classification probability distribution output.

[0025] Further, the construction of a joint loss function and a causal cue word template, and then training the fine-tuned model based on the joint loss function and the causal cue word template to obtain a malicious code intent recognition model, includes: Obtain the standard path description text for each of the three-element association paths; Obtain the attack path description text generated by the fine-tuning model to be trained; A semantic alignment loss function is constructed based on the pre-trained semantic encoder, the standard path description text of each of the three-way association paths, and the attack path description text. The preset cross-entropy loss function and the semantic alignment loss function are fused into the joint loss function; Several training samples are generated based on several of the aforementioned ternary association paths; A vertical causal template is generated based on any of the ternary association paths as the causal prompt word template; Based on several training samples, the fine-tuned model to be trained is trained using the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model.

[0026] In this implementation, the pre-defined cross-entropy loss function and semantic alignment loss function are merged into a joint loss function. The cross-entropy loss function supervises the macro-tactical intent category output by the malicious intent identification head, ensuring the accuracy of intent classification. The semantic alignment loss function ensures that the attack path description text generated by the model is semantically consistent with the standard causal path description text in the graph, resolving logical jumps and illusions, and ensuring that the causal sequence and evolution logic between attack steps do not deviate. The two loss functions work synergistically during joint training, so that when the model being trained and fine-tuned outputs intent labels, its semantic context strictly follows the fixed attack chain timing constraints in the ternary association path. This effectively suppresses the problem that may arise from focusing only on the end label, resulting in correct intent judgment but attack logic jumps or reversed timing.

[0027] Simultaneously, a causal cue word template is introduced to provide causal prior guidance for model reasoning, avoiding illogical reasoning. The training samples are combined with the causal cue word template in the training process of the model to be fine-tuned. This allows the model to be progressively reasoned along a vertical causal chain during each forward propagation, evolving from micro-behavior to technical means, and from technical means to macro-tactical intent. The output is a complete malicious code attack chain that accurately preserves the classification results of macro-tactical intent while strictly adhering to the causal sequence and hierarchical evolution between steps. This overcomes the technical shortcomings of existing models in long-sequence attack reasoning, such as loose logic and inverted timing, significantly improving the accuracy and tracing value of the analysis results.

[0028] Furthermore, the step of obtaining the execution log of the malicious code to be tested, and then parsing the execution log of the malicious code to be tested based on the malicious code intent recognition model to obtain the malicious code attack chain, includes: The execution logs of the malicious code under test are preprocessed to obtain a four-tuple structured event sequence; According to a preset sliding time window, several four-tuple structured events in the four-tuple structured event sequence are aggregated to obtain several meta-events, and then the several meta-events are integrated into a meta-event sequence. The meta-event sequence is input into the malicious code intent recognition model so that the malicious code intent recognition model outputs the malicious code attack chain.

[0029] In this implementation, the execution logs of the malicious code under test are preprocessed to obtain a four-tuple structured event sequence. The original unstructured or semi-structured log data is transformed into a unified four-tuple event representation containing key fields such as subject identifier, action type, operation object, and timestamp. Redundant information and noise interference in the original logs are filtered out, and malicious behaviors scattered across different system levels are normalized into semantically clear and formatted atomic event units, providing a regularized event flow foundation for subsequent attack sequence aggregation and model parsing. Based on this, several four-tuple structured events in the four-tuple structured event sequence are dynamically aggregated according to a preset sliding time window to obtain several meta-events. These meta-events are then integrated into a meta-event sequence in timestamp order. The meta-event sequence is input into the previously trained malicious code intent recognition model, which performs semantic encoding, context association, and intent discrimination on each meta-event in the sequence. Because the malicious code intent recognition model has deeply internalized the hierarchical attack and defense logic from the evolution of micro-level malicious code behavior to technical means, and then from technical means to macro-level tactical intent during the training phase by fusing input tensors, joint loss functions, and causal prompt word templates, when receiving a sequence of meta-events as input, the model can perform intent parsing and attack chain concatenation step by step according to the causal temporal constraints and tactical evolution rules learned during training. Finally, it outputs a logically coherent malicious code attack chain, restoring the discrete events in the original logs into a complete attack narrative that reflects the attacker's true tactical intent and operational rhythm. This solves the problem of attack chain temporal reversal or stage missing caused by the separation of logs and models and the lack of hierarchical aggregation in existing technologies. It provides power grid security operation and maintenance personnel with highly accurate malicious code attack chain restoration results that have tactical evolution logic and hierarchical evolution relationships.

[0030] Further, the step of aggregating several four-tuple structured events in the four-tuple structured event sequence according to a preset sliding time window to obtain several meta-events, and then integrating the several meta-events into a meta-event sequence, includes: Behavioral similarity matching is performed on several of the four-tuple structured events within the sliding time window to obtain behavioral similarity matching results; If the similarity matching result meets the preset semantic consistency condition, then the several four-tuple structured events are aggregated into one meta-event.

[0031] In this implementation, behavioral similarity matching is performed on several four-tuple structured events within the sliding time window to obtain behavioral similarity matching results. Then, when the similarity matching results meet a preset semantic consistency condition, the aforementioned four-tuple structured events are aggregated into a single meta-event, achieving semantic-level merging of preprocessed atomic events. Traditional simple stacking methods based on fixed time windows easily forcibly merge temporally adjacent but semantically unrelated malicious behaviors, or split the same malicious operation sequence separated by time gaps into different windows, leading to mixed logic or broken behavior chains within the generated meta-events. However, the behavioral similarity matching and semantic consistency condition check introduced in this implementation can further calculate and discriminate the behavioral semantics between events within the window, building upon the initial screening of temporal proximity provided by the sliding time window. Only those four-tuple structured events that not only occur at similar times but also have highly consistent behavioral patterns and operational semantics are merged into a single meta-event.

[0032] This mechanism addresses the data redundancy issues caused by high-frequency repetition, continuous homogeneous traversal, and batch calls of the same type in power grid logs. It employs a sliding window aggregation mechanism with dual constraints of time span and behavioral semantics, which can achieve the simplification and condensation of behavioral flow while fully preserving the core characteristics and temporal logic of the attack.

[0033] A second aspect of the present invention provides a power grid malicious code attack chain parsing system based on intent understanding, comprising: The knowledge graph construction module is used to obtain micro-behavioral nodes, technical means nodes, and macro-tactical nodes based on a preset network attack knowledge base, and then use the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes as knowledge graph nodes to construct a three-layer knowledge graph. The tensor generation module is used to obtain ternary association paths based on the three-layer knowledge graph, generate graph node structural features and standardized instruction pairs corresponding to each ternary association path, and then obtain the fusion input tensor of each ternary association path based on the corresponding graph node structural features and standardized instruction pairs. The basic fine-tuning module is used to perform semantic training on the pre-built large language base model based on all the fused input tensors to obtain the basic fine-tuning model. The identification head access module is used to construct a malicious intent identification head and connect the malicious intent identification head to the basic fine-tuning model to obtain the fine-tuning model to be trained. The model training module is used to construct a joint loss function and a causal prompt word template, and then train the fine-tuned model to be trained based on the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model; The attack chain parsing module is used to obtain the execution log of the malicious code under test, and then parse the execution log of the malicious code under test based on the malicious code intent recognition model to obtain the malicious code attack chain. Attached Figure Description

[0034] Figure 1 This is a flowchart illustrating a method for parsing a power grid malicious code attack chain based on intent understanding, provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating another method for parsing power grid malicious code attack chains based on intent understanding, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of a power grid malicious code attack chain parsing system based on intent understanding, provided in an embodiment of the present invention. Detailed Implementation

[0035] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that the following detailed descriptions are exemplary and intended to provide further detailed explanation of the invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects, not to describe a particular order.

[0036] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0037] Before describing this application in detail with reference to the accompanying drawings and embodiments, the application background of this application will first be explained.

[0038] With the acceleration of the digitalization process of smart grids, advanced persistent threats (APTs) and new types of ransomware targeting power grid control systems are becoming increasingly rampant. These malicious code attacks typically exhibit multi-stage and highly covert characteristics. To address this challenge, the industry has begun to introduce graph computing and large language models (LLM) for malicious behavior analysis and attack chain tracing; however, existing technologies have revealed the following core flaws in practical applications: First, existing security knowledge graphs lack hierarchical abstraction, making it difficult to extract rigorous causal and temporal constraints. Traditional provenance graphs or security knowledge graphs often adopt a flat attribute graph structure, mixing all micro-entities such as files, processes, and network communications together. This structure makes it difficult to quantify the hierarchical evolution relationship between underlying micro-behaviors and macro-tactical intentions. When faced with massive amounts of noisy industrial control logs, flat graphs are prone to introducing spurious correlation noise, resulting in loose logic in the extracted attack chains and even fallacies of reversed time sequences.

[0039] Second, a significant semantic gap exists between underlying security logs and large language models (LLMs). While LLMs possess powerful reasoning capabilities, the underlying API calls or industrial control binary instructions are completely disconnected from natural language in terms of mathematical semantic space. Most existing solutions forcibly convert system logs into text prompts using predefined rules and feed them to the large model. This crude text concatenation prevents the LLM from truly understanding the microscopic physical mechanisms of malicious operations at the vector level, resulting in enormous computational and token overhead and easily triggering model illusions.

[0040] Third, fine-tuning large-scale security models lacks the constraints of physical laws governing attack and defense, making them prone to logical leaps. Existing fine-tuning of large-scale security models typically relies solely on standard cross-entropy loss, focusing only on the accuracy of the model's "next word prediction," while ignoring the rigorous tactical evolution logic within the network attack and defense system. This leads to the model easily generating analytical results that deviate from actual physical laws governing attack and defense when reasoning about complex, long-sequence attacks (e.g., directly inferring the intent of "data corruption" without obtaining "initial access" permissions), thus losing the logical rigor that security analysis reports should possess.

[0041] Fourth, the inference overload challenge posed by high-frequency fragmented logs in industrial control environments: power grid terminals and network probes generate hundreds of millions of discrete behavior logs daily, especially when malicious code performs lateral movement scanning or file encryption, which generates a large number of high-frequency repetitive operation records. If these fragmented logs are directly input into the context window of a large model, not only will the token length limit be instantly exceeded, but the excessive background noise will also cause the attention of the large model to be scattered, making it impossible to achieve real-time automated attack chain deconstruction.

[0042] Please refer to Figure 1 To address the aforementioned technical problems, the first aspect of this invention provides a method for parsing power grid malicious code attack chains based on intent understanding, comprising the following steps: S1. Based on a preset network attack knowledge base, obtain micro-behavioral nodes, technical means nodes, and macro-tactical nodes, and then use the micro-behavioral nodes, technical means nodes, and macro-tactical nodes as graph nodes to construct a three-layer knowledge graph; S2. Obtain ternary association paths based on the three-layer knowledge graph, generate graph node structure features and standardized instruction pairs corresponding to each ternary association path, and then obtain the fusion input tensor of each ternary association path based on the corresponding graph node structure features and standardized instruction pairs. S3. Based on all the fused input tensors, perform semantic training on the pre-constructed large language base model to obtain the basic fine-tuning model; S4. Construct a malicious intent recognition head and connect the malicious intent recognition head to the basic fine-tuning model to obtain the fine-tuning model to be trained; S5. Construct a joint loss function and a causal prompt word template, and then train the fine-tuned model to be trained based on the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model; S6. Obtain the execution log of the malicious code to be tested, and then parse the execution log of the malicious code to be tested based on the malicious code intent recognition model to obtain the malicious code attack chain.

[0043] The aforementioned method for analyzing power grid malware attack chains based on intent understanding deconstructs the low-level micro-operations, mid-level attack techniques, and high-level tactical objectives of a malware attack process into a hierarchical structure. It constructs a three-layer knowledge graph using micro-behavioral nodes, technical means nodes, and macro-tactical nodes as hierarchical graph nodes. This hierarchical knowledge graph architecture breaks away from the limitations of traditional flat tracing graphs where all entities are mixed together. By distinguishing between micro-behavioral nodes, technical means nodes, and macro-tactical nodes, the three-layer knowledge graph can quantify the tactical evolution logic and hierarchical relationships from the specific micro-behaviors of the low-level malware to the mid-level technical means, and from the mid-level technical means to the high-level macro-tactical intent. This provides a data foundation for subsequently understanding the causal sequence between persistent malware and generating attack chains.

[0044] Then, this invention extracts the complete causal chain from micro-behavioral nodes to technical means nodes and from technical means nodes to macro-tactical nodes from the ternary association paths extracted from the three-layer knowledge graph. For the graph node structural features generated for each ternary association path, the topological dependency and temporal context of the path in its local subgraph are captured; simultaneously, the generated standardized instruction pairs translate attack behaviors into controlled text descriptions containing attack and defense physical laws, providing a unified supervision signal for subsequent model training. By obtaining the fused input tensor of each ternary association path corresponding to the graph node structural features and the standardized instruction pairs, semantic training is performed based on all fused input tensors, enabling the large language foundation model to initially establish the mapping capability from low-level micro-behavior to mid-level technology and high-level tactics, completing basic attack and defense semantic adaptation. Subsequently, a specially constructed malicious intent recognition head is connected to this basic fine-tuning model, mapping the abstract semantic vector output by the model to specific macro-tactical classification results, resulting in a fine-tuning model to be trained that can classify malicious code behavior.

[0045] During the training phase, causal cue word templates are introduced to provide causal guidance for model inference, preventing the model from engaging in illogical reasoning. Under the joint supervision of the joint loss function and the causal cue word templates, the model is fine-tuned, driving it not only to accurately identify malicious intent at each stage but also to learn the inherent temporal relationship of the tactical progression of malicious code under the physical laws of attack and defense. This enables the final malicious code intent recognition model to reconstruct a logically rigorous and temporally correct complete malicious code attack chain when parsing the execution logs of the malicious code under test, thereby solving the problems of inverted attack chain temporal order and loose logic in existing technologies and significantly improving the accuracy of attack chain parsing results.

[0046] Please refer to Figure 2 In another specific embodiment, the intent-understanding-based power grid malware attack chain parsing method includes the following three core steps: Step 1: TTB (Tactic-Technique-Behavior) Graph Construction and Malicious Instruction Set Generation (Offline Knowledge Engineering). Addressing the problem that existing malware analysis methods overly rely on feature matching or statistical patterns and lack causal modeling of the relationship between attack behavior and tactical intent, this step first constructs a unified three-layer TTB knowledge graph and further generates a standardized malicious analysis instruction set oriented towards a large language model. Input threat intelligence data includes API sequences, system calls, network packets, and the MITRE ATT&CK expert knowledge base. Specifically, based on MITRE ATT&CK and open-source threat intelligence, three types of nodes are extracted and standardized: macro-level tactical nodes, such as lateral movement, privilege escalation, and defense evasion; technical nodes, such as remote service vulnerability exploitation, credential abuse, and process injection; and micro-level behavioral nodes, such as API calls, system call parameters, sensitive file access, and typical process operations. Then, by statistically analyzing the temporal relationships in historical attack samples, the causal confidence between nodes is calculated, and cross-domain mapping edges between layers and causal edges within the same layer of the technical means layer are constructed, thus forming a TTB graph with hierarchical structure and temporal constraints. Based on this, the cross-layer mapping paths and high-confidence causal paths in the graph are traversed, and the ternary association path of "micro-behavior—technical means—macro-tactics" is automatically extracted to generate a standardized malicious analysis instruction set (Prompt-Pair) for the large language model. Each instruction is represented in structured form as: "Macro-tactics: [Defense and evasion (TA0005)]; Technical means: [Process injection (T1055)]; Micro-behavior sequence: [API: CreateRemoteThread, target: lsass.exe]". This instruction set serves as a supervision signal for subsequent model training, realizing the mapping learning from low-level behavior to high-level intent. To further align the structured semantics in the graph with the language model representation space, this step also includes graph representation learning and semantic alignment. Feature aggregation is performed through a graph attention network (GAT), and the alignment loss L_align is minimized, so that the node and edge information in the graph can be effectively transferred to the subsequent semantic understanding stage.

[0047] Step 2: Two-Stage Instruction Fine-Tuning and Intent Recognition Model Construction (Offline Model Fine-Tuning). Addressing the semantic drift and inconsistency in reasoning inherent in general-purpose language models in complex attack and defense scenarios, this step employs a two-stage instruction fine-tuning mechanism, introducing graph semantic injection and causal constraints to construct an intent recognition model for malicious code analysis. First, in the graph feedforward injection and LoRA fine-tuning stages, the large language model is lightweighted and fine-tuned using the Low-Rank Adaptation (LoRA) method. Structured features in the TTB graph are mapped to continuous soft prefixes (Soft Prompts), which are then fed into the model's input space via graph feedforward injection, completing basic attack and defense semantic adaptation and aligning the graph semantics with the language model's representation space. Subsequently, in the intent recognition head and causal constraint training stages, a malicious intent recognition head is introduced into the model's output, performing discriminative mapping on the model's implicit representation and outputting macro-tactical-level intent classification results. Simultaneously, combining the TTB hierarchy and inter-technology dependencies (ITD), a TTB / ITD causal module is constructed to generate causal prompt templates. A joint loss, L_causal, is introduced to constrain the attack paths generated by the model, ensuring they conform to the causal evolution patterns in the graph. The final output is a fine-tuned LLM that integrates a malicious intent detection header and possesses causal logic constraints.

[0048] Step 3: Real-time Behavior Flow Compression and Attack Chain Deconstruction (Online Practical Analysis). In the online practical analysis phase, targeting the massive logs of malicious code in the power grid, this step achieves structured analysis of the attack chain of unknown malicious code through behavior flow compression and semantic reasoning. First, the original logs of the sample to be tested are preprocessed, and the four-tuple E is extracted through standardization, converting discrete behaviors into event representations in a unified format. Subsequently, based on a sliding window mechanism with temporal and semantic consistency, repetitive or highly similar behaviors are aggregated and compressed to generate high-information-density events e_meta. On this basis, the structured features of the meta-events are mapped to the fine-tuned model input space, and semantic reasoning is performed in conjunction with contextual information. Based on the fine-tuned LLM and intent recognition head, tactical intents at each stage are identified, and the attack chain is constructed in chronological order. Through online feature mining and front-end capture, macro-tactical labels can be automatically matched, ultimately outputting a complete, traceable, and structured temporal malicious code attack chain.

[0049] Furthermore, the step of acquiring micro-behavioral nodes, technical means nodes, and macro-tactical nodes based on a preset network attack knowledge base, and then constructing a three-layer knowledge graph using the micro-behavioral nodes, technical means nodes, and macro-tactical nodes as graph nodes, includes: Based on a pre-defined network attack knowledge base, obtain a set of micro-behavioral nodes, a set of technical means nodes, and a set of macro-tactical nodes; Based on the network attack knowledge base, a cross-layer mapping edge pointing to the corresponding technical means node is established for each micro-behavior node in the set of micro-behavior nodes; Based on the network attack knowledge base, a cross-layer mapping edge pointing to the corresponding macro-tactical node is established for each of the technical means nodes in the set of technical means nodes; The three-layer knowledge graph is constructed using all the micro-behavioral nodes, all the technical means nodes, and all the macro-tactical nodes as graph nodes, and all the cross-layer mapping edges as graph edges.

[0050] In one specific embodiment, the MITRE ATT&CK Tactics / Techniques standard mapping library is used, combined with open-source threat intelligence data as a network attack knowledge base. The open-source threat intelligence data includes labeled malicious attack samples, API call sequences generated during sandbox operation, system call parameters, process operation logs, network communication behaviors and corresponding behavior tags, etc.

[0051] Define the set of micro-behavioral nodes This includes API calls, system call parameters, file access, process operations, registry modifications, and network communication. An attribute vector is generated for each node for subsequent encoding. The micro-behavior is used to create a node set. This serves as the micro-behavior layer of the three-layer knowledge graph.

[0052] Define the set of technical means nodes This involves semantically abstracting discrete micro-level behaviors, corresponding them to specific attack techniques within the MITRE ATT&CK framework, such as process injection, credential abuse, startup item persistence, and remote vulnerability exploitation, thereby achieving a semantic upgrade from low-level behavior to mid-level techniques. This is achieved through a set of technical means nodes. As a technology layer.

[0053] Define the set of macro-tactical nodes This characterizes the core tactical objectives of malicious code attacks, covering attack phases such as initial access, code execution, persistent persistence, privilege escalation, defense evasion, lateral movement, and data theft, achieving semantic condensation from mid-level techniques to high-level intent. It uses a macro-level set of tactical nodes. As a macro-tactical layer.

[0054] Based on the network attack knowledge base, a cross-layer mapping edge is established for each micro-behavioral node in the set of micro-behavioral nodes, pointing to the corresponding technical means node; based on the network attack knowledge base, a cross-layer mapping edge is established for each technical means node in the set of technical means nodes, pointing to the corresponding macro-tactical node. Specifically, this includes establishing a bottom-up membership relationship based on the network attack knowledge base. This includes edges pointing from the micro-behavioral layer to the technical means layer, for example, pointing a micro-behavioral node with the attribute of API call / registry modification to a technical means node with the attribute of startup item modification. It also includes edges pointing from the technical means layer to the macro-tactical layer, for example, pointing a technical means node with the attribute of startup item modification to a macro-tactical node with the attribute of persistence.

[0055] In a preferred embodiment, in addition to the cross-layer mapping edges constructed above, at the technical means layer ( Internally, causal edges are also established to construct horizontal temporal causal relationships, so as to generate another horizontal causal template as another causal prompt word template in subsequent steps.

[0056] Based on the temporal evolution patterns of historical attack chain samples, a lateral directed causal relationship is established between technical means nodes. A temporal confidence algorithm is used to calculate the causal edge weights, quantifying the transition probability between attack techniques. The directed edge between any two technical means nodes... The formula for calculating the weight is: in, As an indicator function, it indicates that in In the attack chain sample, the technical means nodes Prior to technical means nodes The number of valid occurrences. The system only retains... High-confidence causal edges are used to eliminate weakly correlated noise.

[0057] In this implementation, a set of micro-behavioral nodes, a set of technical means nodes, and a set of macro-tactical nodes are extracted from a pre-defined network attack knowledge base. Malicious attack elements are hierarchically categorized according to a standardized attack and defense knowledge system. Then, a cross-layer mapping edge is established for each micro-behavioral node pointing to its corresponding technical means node, and simultaneously, a cross-layer mapping edge is established for each technical means node pointing to its corresponding macro-tactical node. This establishes the tactical evolution logic and hierarchical evolution relationship, from the specific micro-behavioral behavior of the underlying malicious code to the mid-level technical means, and from the mid-level technical means to the high-level macro-tactical intent. This three-layer knowledge graph construction method eliminates the defects of fuzzy causal relationships and reversed time sequences caused by the mixing of underlying entities and high-level intents in existing source graphs. It provides a well-structured and clearly defined hierarchical graph data foundation for subsequently extracting ternary association paths from the graph and generating fusion input tensors with attack and defense physical constraints. This significantly improves the accuracy of identifying and connecting tactical evolution logic during malicious code attack chain analysis.

[0058] Further, the step of obtaining ternary association paths based on the three-layer knowledge graph and generating graph node structural features and standardized instruction pairs corresponding to each ternary association path includes: Determine the set of neighbor nodes for each graph node, and then perform feature aggregation on each graph node based on the corresponding set of neighbor nodes to obtain the graph node structure features of each graph node; For any given micro-behavioral node, determine the technical means node that the micro-behavioral node points to, and determine the macro-tactical node that the technical means node points to, and then generate a ternary association path based on the micro-behavioral node, the technical means node, and the macro-tactical node. For any of the three-element association paths, the graph node structure features corresponding to the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes are taken as the graph node structure features of the three-element association path. For any of the three-ary association paths, a corresponding standardized instruction pair is generated based on a preset natural language template.

[0059] In one specific embodiment, to capture the topological and causal features of nodes in the TTB three-layer graph, a graph attention network (GAT) is used to analyze the graph nodes. and its neighbor node set Perform feature aggregation. Graph nodes. High-dimensional graph node structure features The formula for generating it is: in, This is the initial attribute vector for the node. The weight matrix is ​​a learnable matrix. For graph nodes With graph nodes Attention coefficient between them. It is a non-linear activation function used to extract deep features from graph nodes.

[0060] Then, the high-confidence cross-layer mapping paths and same-layer causal paths of the TTB causal graph are traversed to extract the "micro-behavior—technical means—macro-tactical" ternary association path. Based on a preset natural language template, a dataset of instruction pairs for fine-tuning the large model is automatically generated, achieving standardized and automated generation of instruction sets and providing unified supervision signals for subsequent model training. As an example, the input format of a standardized instruction pair can be: "Macro-level tactics: [Defense and evasion (TA0005)]; Technical means: [Process injection (T1055)]; Micro-level behavioral sequence: [API: CreateRemoteThread, Target: lsass.exe]".

[0061] This example standardized instruction corresponds to a micro-behavioral node attribute of API call, a technical means node attribute of process injection, and a macro-tactical node attribute of a three-way association path of defense and evasion. "API:CreateRemoteThread" is the Windows operating system's application programming interface. Calling this function means creating a remote thread in a target process, which is the specific code-level operation for implementing the aforementioned process injection technique. "Target: lsass.exe" refers to the object of this API operation, i.e., the host process being injected. lsass.exe is a subsystem process in the Windows system responsible for local security authentication; it often stores the user's plaintext password or credential hash in memory, making it a common targeted target for credential theft. TA0005 is the official designation for this tactic in the MITRE ATT&CK knowledge base, and T1055 is the specific technical designation defined in MITRE ATT&CK.

[0062] In this implementation, for each graph node in the three-layer knowledge graph, its set of neighboring nodes is first determined, and feature aggregation is performed on the graph node based on this set of neighboring nodes. This ensures that the high-dimensional graph node structural features obtained for each graph node not only encode the node's own attribute semantics but also integrate the topological context and relationships within its local subgraph. Based on this, starting from any micro-behavioral node, along the established cross-layer mapping edge, the technical means node pointed to by the micro-behavioral node and the macro-tactical node pointed to by the technical means node are determined sequentially. These three graph nodes belonging to different semantic levels are then linked together to generate a ternary association path. This path binds the specific low-level operations, the mid-level attack techniques employed, and the attacker's ultimate high-level tactical intent in the attack event into a complete causal unit, explicitly extracting an attack semantic chain with clear temporal dependencies and logical progression relationships from the graph.

[0063] For any generated ternary association path, the graph node structure features of its corresponding micro-behavioral nodes, technical means nodes, and macro-tactical nodes are collectively used as the graph node structure features of that ternary association path. Simultaneously, based on a preset natural language template, standardized instruction pairs are generated for each ternary association path, translating the structured graph path into a controlled natural language description. These standardized instruction pairs, with a unified sentence structure, regulate the physical laws of attack and defense and the logic of tactical evolution, providing semantically regular and temporally clear textual supervision signals for subsequently injecting graph structure data into a large language model.

[0064] Through the above method, each ternary association path extracted from the three-layer knowledge graph simultaneously possesses structured graph node structural features and semantically standardized instruction pairs. These two modalities of data mutually corroborate and constrain each other. When input into a large language model for training, they jointly force the model to adhere to the hierarchical progression and causal temporal relationship in both the feature space and semantic space, where malicious code maps from micro-level behavior to technical means, and from technical means to macro-level tactical intentions in network attack and defense. This helps overcome the shortcomings of existing methods, such as loose logic or reversed temporal order in large model attack chain parsing due to feature flattening and arbitrary text prompts.

[0065] Further, the step of obtaining the fusion input tensor for each of the ternary association paths based on the corresponding graph node structural features and the normalization instructions includes: Construct the perceptron function and the alignment loss function; For any of the given ternary association paths: Obtain the semantic vector of the behavior node corresponding to the micro-behavioral node, the semantic vector of the technical node corresponding to the technical means node, and the semantic vector of the tactical node corresponding to the macro-tactical node; Based on the semantic vector of the behavior node, the graph node structure features corresponding to the micro-behavioral node are mapped to the corresponding continuous soft cue vector through the perceptron function and the alignment loss function; Based on the semantic vector of the technology node, the graph node structure features corresponding to the technology node are mapped into corresponding continuous soft cue vectors through the perceptron function and the alignment loss function; Based on the tactical node semantic vector, the graph node structure features corresponding to the macro tactical node are mapped to the corresponding continuous soft cue vector through the perceptron function and the alignment loss function; Obtain the word embedding vector corresponding to the standardized instruction pair; The continuous soft cue vectors corresponding to the micro-behavioral nodes, the continuous soft cue vectors corresponding to the technical means nodes, the continuous soft cue vectors corresponding to the macro-tactical nodes, and the word embedding vectors are concatenated to obtain the fusion input tensor of the ternary association path.

[0066] In one specific embodiment, nodes of the TTB three-layer knowledge graph are extracted. Natural language description text The input is fed into a word segmenter, and the corresponding semantic vector is obtained through a pre-trained embedding layer. : in, A word segmenter designed to support large language models. For pre-trained embedding layers of large language models, This is an average pooling operation. It calculates the average value of the embedding vectors of all words in the input sequence along each dimension, and aggregates the variable-length word vector sequence into a single vector of fixed size.

[0067] Based on the above method, the semantic vectors of the behavioral nodes corresponding to the micro-behavioral nodes, the semantic vectors of the technical nodes corresponding to the technical means nodes, and the semantic vectors of the tactical nodes corresponding to the macro-tactical nodes are obtained respectively.

[0068] Then, construct the multilayer perceptron function. , to define the structural features of the graph nodes Projected onto the semantic dimension space of a large language model, forming continuous soft cue vectors. The specific calculation process is shown in the following formula: By minimizing the alignment loss function This is done to update the learnable parameters of the multilayer perceptron and force semantic consistency between the graph features and the large model semantic space. In the formula, , , , Here are the learnable parameters of the multilayer perceptron, and ReLU is the activation function. |V| represents the total number of nodes in the graph. It is the square of the L2 norm. For graph nodes The corresponding semantic vectors enable precise alignment between graph semantics and large model semantics.

[0069] The continuous soft cue vectors corresponding to the micro-behavioral nodes , corresponding to the continuous soft cue vector of the aforementioned technical means node , corresponding to the continuous soft cue vector of the macro-tactical node The word embedding vectors are concatenated sequentially to construct a multimodal fusion input tensor. This allows the model to pre-acquire global causal topological knowledge of the graph, as shown in the following equation: In the formula, For standardized instruction pairs The word embedding vector, [;] represents the sequence concatenation operation.

[0070] In this implementation, a perceptron function and an alignment loss function are constructed. The perceptron function projects the structural features of the knowledge graph nodes onto the semantic dimension space of the large language model. The alignment loss function uses the semantic vectors of the corresponding node's behavioral node, technical node, and tactical node as supervision signals to constrain the perceptron function to align the knowledge graph structural information with the corresponding text semantic information during the mapping process. This achieves accurate alignment between the knowledge graph semantics and the large model semantics, ensuring that the topological dependencies and causal constraints of attack and defense contained in the three-layer knowledge graph are not diluted or distorted during the modality conversion process, but are fully encoded into continuous soft cue vectors.

[0071] For any ternary association path, the graph node structure features of its micro-behavioral nodes, technical means nodes, and macro-tactical nodes are taken as input. Through the synergistic effect of the perceptron function and the alignment loss function, the graph node structure features of the above three levels are mapped one by one into corresponding continuous soft cue vectors. Since the structural features of each graph node have been fused with the topological context of the local subgraph through neighbor aggregation during generation, the continuous soft cue vectors obtained after perceptron mapping carry the structured dependencies of the node in its respective attack chain segment when entering the semantic space of the large language model. This allows the model to directly perceive the structured constraints between behavioral nodes and technical nodes, and between technical nodes and tactical nodes, from continuous vector signals. At the same time, the word embedding vectors of the standardized instruction pairs are obtained. These word embedding vectors accurately describe the attack semantics and tactical evolution logic represented by the ternary association path in text form.

[0072] Subsequently, the continuous soft cue vectors of micro-behavioral nodes, technical means nodes, and macro-tactical nodes, along with the word embedding vectors of standardized instruction pairs, are sequentially concatenated to form the fusion input tensor of this ternary association path. This allows the large language model to receive this fusion input tensor, where the front-end continuous soft cue vectors pre-lay strict physical constraints of attack and defense and temporal causal constraints in the semantic space for subsequent text semantic reasoning. This prevents the model from generating jumpy inferences that deviate from actual attack logic during autoregressive generation. This method of constructing the fusion input tensor effectively bridges the alignment bias and information loss caused by the separation and independent encoding of graph structure data and natural language cue words in existing technologies. This allows the invention to combine the capabilities of hierarchical knowledge graphs and large language models to understand the intent of malicious code and construct attack chains, thereby improving the accuracy of malicious code attack chain parsing results in terms of causal temporal and tactical logic.

[0073] Furthermore, the semantic training of the pre-constructed large language foundation model based on all the fused input tensors to obtain the basic fine-tuning model includes: Freeze the main intervention training parameters of the large language base model and introduce a low-rank matrix into the large language base model; Construct a forward propagation function based on the main intervention training parameters, the low-rank matrix, and all the fused input tensors; Based on the forward propagation function, the large language base model is semantically trained to obtain a basic fine-tuning model.

[0074] In one specific embodiment, a base fine-tuned model is trained using the LoRA lightweight fine-tuning method. The main intervention training parameters of the large language model are then frozen. On the query and value projection matrix side of the Transformer layer, a low-rank matrix is ​​introduced in parallel. With low-rank matrix (where rank) At this point, the forward propagation formula for the model is: in, The batch matrix formed by all the fused input tensors.

[0075] Based on the forward propagation function, driven by the fused input tensor, the dataset is fine-tuned using standardized instructions, and the semantic training of the large language base model is performed. This enables the model to initially establish the mapping capability from low-level micro-behavior to mid-level technology and high-level tactics, and complete the basic offensive and defensive semantic adaptation.

[0076] In this implementation, by freezing the main intervention training parameters of the large language base model, the general semantic understanding, logical reasoning, and language generation capabilities accumulated during the pre-training phase are fully preserved. This avoids the model forgetting problem that may occur due to full parameter fine-tuning, ensuring that the model still possesses robust language foundation capabilities when facing specialized domain tasks such as power grid malicious code attacks. Based on this, a low-rank matrix is ​​introduced into the large language base model to approximate the parameter update amount through low-rank decomposition. This allows the model to adapt to the downstream task of malicious code attack chain parsing by adjusting a very small proportion of additional parameters without significantly increasing the number of trainable parameters or computational overhead. Then, based on the frozen main intervention training parameters, the introduced low-rank matrix, and all fused input tensors, a forward propagation function is constructed. Graph structure information and attack semantic information are injected into the model's forward computation process via the fused input tensor. Gradient updates are performed only on the low-rank matrix portion, enabling the model to initially establish a mapping capability from low-level micro-behavior to mid-level technology and high-level tactics, completing basic offensive and defensive semantic adaptation. This design ensures that the model training process is highly sensitive to the causal timing of the attack chain, while maintaining the semantic generalization of the pre-trained base model.

[0077] Further, the step of constructing a malicious intent identification head and connecting the malicious intent identification head to the basic fine-tuning model to obtain the fine-tuning model to be trained includes: A first fully connected layer is constructed, and a non-linear activation layer is constructed on top of the first fully connected layer. A second fully connected layer is then constructed on top of the non-linear activation layer, and a normalization layer is constructed on top of the second fully connected layer to form the malicious intent identification head. Obtain the sequence latent feature vector output by the basic fine-tuning model; The hidden feature vectors of the sequence are connected to the first fully connected layer to obtain the fine-tuned model to be trained.

[0078] In one specific embodiment, the latent feature vectors of the output sequence are found in the last layer of the Transformer in the large language model. Above this, a dedicated malicious intent detection head is attached. This head consists of two fully connected layers and non-linear activation and Softmax normalization layers. It maps the model's abstract semantic vectors into specific macro-tactical classification results. The calculation formula is shown below: in, The sequence latent feature vector output by LLM. It is a non-linear activation function. Learnable parameters for head recognition The probability distribution for classifying macro-tactical intentions.

[0079] As shown in the above equation, the first fully connected layer is , For nonlinear activation functions, in nonlinear activation functions Build a second fully connected layer on top of that. Finally, a Softmax normalization layer is built on the second fully connected layer to form a malicious intent detection head. .

[0080] In this implementation, a malicious intent detection head is constructed by sequentially stacking a first fully connected layer, a nonlinear activation layer, a second fully connected layer, and a normalization layer. This allows the model's abstract semantic vectors to be mapped to specific macro-tactical classification results. The first fully connected layer performs preliminary dimensionality transformation and feature reorganization on the input semantic features. The nonlinear activation layer, located between the two fully connected layers, introduces nonlinear expressive power into the detection head, enabling this sub-network to fit the complex decision boundaries between the implicit semantics of the attack sequence and the high-dimensional intent category space, rather than simply learning simple linearly separable patterns. The second fully connected layer further maps the nonlinearly activated features to the intent category dimension, and then the normalization layer transforms the output into a standardized intent category probability distribution.

[0081] The sequence latent feature vector output by the basic fine-tuning model is obtained and directly fed into the first fully connected layer, thus obtaining the fine-tuning model to be trained. Since the basic fine-tuning model has already internalized the hierarchical attack and defense rules and causal temporal dependencies from micro-behavior to technical means, and from technical means to macro-tactical intentions, through the fusion of input tensors during the early semantic training phase, its output sequence latent feature vector is rich in tactical progressive semantics and structured constraint information between successive steps in the attack chain. Feeding this high-quality feature vector directly into the malicious intent identification head is equivalent to enabling the identification head to fully utilize the full sequence context and inter-layer causal relationships accumulated by the basic fine-tuning model when classifying the macro-intent of each attack step, thereby obtaining the macro-tactical intent classification probability distribution output.

[0082] Further, the construction of a joint loss function and a causal cue word template, and then training the fine-tuned model based on the joint loss function and the causal cue word template to obtain a malicious code intent recognition model, includes: Obtain the standard path description text for each of the three-element association paths; Obtain the attack path description text generated by the fine-tuning model to be trained; A semantic alignment loss function is constructed based on the pre-trained semantic encoder, the standard path description text of each of the three-way association paths, and the attack path description text. The preset cross-entropy loss function and the semantic alignment loss function are fused into the joint loss function; Several training samples are generated based on several of the aforementioned ternary association paths; A vertical causal template is generated based on any of the ternary association paths as the causal prompt word template; Based on several training samples, the fine-tuned model to be trained is trained using the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model.

[0083] In one specific embodiment, based on the hierarchical relationship of the TTB graph and the causal dependency relationship between technologies, a Tactical-Technology-Behavior (TTB) template is constructed as a vertical causal prompt word template to achieve vertical causal logic constraints, such as: "Malicious code achieves {technical means} by executing {micro-behavior}, the purpose of which is to achieve {macro-tactics}".

[0084] In a preferred embodiment, based on the technical means layer ( The same-layer causal edges (Causal Edges) of different technical means nodes within the internal quality inspection are used to construct inter-technical dependency (ITD) templates as lateral causal prompt word templates. This is used to establish lateral causality and implement constraints on the evolution of lateral attack techniques. For example: "When technical means { are identified..." Following this, based on causal probability, the next step is highly likely to evolve into technological means. }".

[0085] Then, a joint loss function of cross-entropy loss and causal semantic alignment loss is adopted to achieve synergistic optimization of intent classification accuracy and attack chain causal consistency. The formula for the total loss function is as follows: in This is the standard cross-entropy loss function, used for intent classification accuracy; The loss function is the causal semantic alignment loss function for the attack chain. The weights represent the weights of the causal semantic alignment loss. The semantic alignment loss function is defined as follows: in, A pre-trained Sentence-BERT semantic encoder for the security domain. Attack path description text generated for the model to be trained and fine-tuned. This is the standard path description text corresponding to the i-th ternary association path. This represents the number of ternary association path samples in this batch of training. By minimizing this loss, the attack paths generated by the model are forced to be semantically consistent with the standard causal paths in the graph, thus completely resolving the problems of logical jumps and illusions.

[0086] Based on the aforementioned semantic alignment loss function, to ensure that the total number of attack path description texts generated by the fine-tuning model corresponds to the number of ternary association path samples in this batch of training, when generating several training samples based on several ternary association paths, for any given ternary association path, a corresponding input sequence text is generated as a model training sample. This input training text can be structured text describing the behavior to be analyzed. The macro-tactical node attributes of the ternary association path are used as the malicious intent label corresponding to this training sample. The attack path description text generated by the fine-tuning model based on this input sequence text... That is, the standard path description text corresponding to the ternary association path. .

[0087] In this implementation, the pre-defined cross-entropy loss function and semantic alignment loss function are merged into a joint loss function. The cross-entropy loss function supervises the macro-tactical intent category output by the malicious intent identification head, ensuring the accuracy of intent classification. The semantic alignment loss function ensures that the attack path description text generated by the model is semantically consistent with the standard causal path description text in the graph, resolving logical jumps and illusions, and ensuring that the causal sequence and evolution logic between attack steps do not deviate. The two loss functions work synergistically during joint training, so that when the model being trained and fine-tuned outputs intent labels, its semantic context strictly follows the fixed attack chain timing constraints in the ternary association path. This effectively suppresses the problem that may arise from focusing only on the end label, resulting in correct intent judgment but attack logic jumps or reversed timing.

[0088] Simultaneously, a causal cue word template is introduced to provide causal prior guidance for model reasoning, avoiding illogical reasoning. The training samples are combined with the causal cue word template in the training process of the model to be fine-tuned. This allows the model to be progressively reasoned along a vertical causal chain during each forward propagation, evolving from micro-behavior to technical means, and from technical means to macro-tactical intent. The output is a complete malicious code attack chain that accurately preserves the classification results of macro-tactical intent while strictly adhering to the causal sequence and hierarchical evolution between steps. This overcomes the technical shortcomings of existing models in long-sequence attack reasoning, such as loose logic and inverted timing, significantly improving the accuracy and tracing value of the analysis results.

[0089] Furthermore, the step of obtaining the execution log of the malicious code to be tested, and then parsing the execution log of the malicious code to be tested based on the malicious code intent recognition model to obtain the malicious code attack chain, includes: The execution logs of the malicious code under test are preprocessed to obtain a four-tuple structured event sequence; According to a preset sliding time window, several four-tuple structured events in the four-tuple structured event sequence are aggregated to obtain several meta-events, and then the several meta-events are integrated into a meta-event sequence. The meta-event sequence is input into the malicious code intent recognition model so that the malicious code intent recognition model outputs the malicious code attack chain.

[0090] In this implementation, the execution logs of the malicious code under test are preprocessed to obtain a four-tuple structured event sequence. The original unstructured or semi-structured log data is transformed into a unified four-tuple event representation containing key fields such as subject identifier, action type, operation object, and timestamp. Redundant information and noise interference in the original logs are filtered out, and malicious behaviors scattered across different system levels are normalized into semantically clear and formatted atomic event units, providing a regularized event flow foundation for subsequent attack sequence aggregation and model parsing. Based on this, several four-tuple structured events in the four-tuple structured event sequence are dynamically aggregated according to a preset sliding time window to obtain several meta-events. These meta-events are then integrated into a meta-event sequence in timestamp order. The meta-event sequence is input into the previously trained malicious code intent recognition model, which performs semantic encoding, context association, and intent discrimination on each meta-event in the sequence. Because the malicious code intent recognition model has deeply internalized the hierarchical attack and defense logic from the evolution of micro-level malicious code behavior to technical means, and then from technical means to macro-level tactical intent during the training phase by fusing input tensors, joint loss functions, and causal prompt word templates, when receiving a sequence of meta-events as input, the model can perform intent parsing and attack chain concatenation step by step according to the causal temporal constraints and tactical evolution rules learned during training. Finally, it outputs a logically coherent malicious code attack chain, restoring the discrete events in the original logs into a complete attack narrative that reflects the attacker's true tactical intent and operational rhythm. This solves the problem of attack chain temporal reversal or stage missing caused by the separation of logs and models and the lack of hierarchical aggregation in existing technologies. It provides power grid security operation and maintenance personnel with highly accurate malicious code attack chain restoration results that have tactical evolution logic and hierarchical evolution relationships.

[0091] Further, the step of aggregating several four-tuple structured events in the four-tuple structured event sequence according to a preset sliding time window to obtain several meta-events, and then integrating the several meta-events into a meta-event sequence, includes: Behavioral similarity matching is performed on several of the four-tuple structured events within the sliding time window to obtain behavioral similarity matching results; If the similarity matching result meets the preset semantic consistency condition, then the several four-tuple structured events are aggregated into one meta-event.

[0092] This step addresses the technical characteristics of malicious code logs in the power grid environment, which are characterized by high frequency, high redundancy, and strong heterogeneity. Through multi-source log standardization, adaptive semantic compression, and context-aware reasoning, it achieves noise reduction and high information density conversion of real-time behavior streams, and completes the dynamic deconstruction of unknown malicious code attack chains and tactical intent localization.

[0093] In one specific embodiment, field parsing, de-identification cleaning, and invalid noise removal are performed on unstructured, heterogeneous raw logs; core behavioral elements are uniformly extracted to construct standardized four-tuple structured event representations. in, Provide a precise timestamp for the event; The main identifier is such as process PID or IP; For action type, it corresponds to the attribute of the micro-behavior node in the micro-behavior layer of the graph, such as API or instruction name; The target object to be operated on is, for example, a file path, a registry key, or a target IP address.

[0094] To address the data redundancy issues caused by high-frequency repetition, continuous homogeneous traversal, and batch calls of the same type in power grid logs, a sliding window aggregation mechanism with dual constraints of time span and behavioral semantics is adopted. This mechanism simplifies and condenses the behavior flow while fully preserving the core characteristics and temporal logic of the attack.

[0095] Redundant event detection: Set a time window threshold Traverse the standardized temporal behavior event stream. Perform behavior similarity matching frame by frame within the window. The redundancy event judgment rule is as follows: in, For the i-th four-tuple structured event, This is the main identifier of the i-th four-tuple structured event. Let i be the action type of the i-th four-tuple structured event. This is the operation object for the i-th quaternion structured event.

[0096] If consecutive occurrences appear within the window indivual( >10) The event satisfies the subject ,action and operation objects If the semantics are consistent, it is determined to be a homogeneous redundant event. All homogeneous redundant events within the window are aggregated and merged to generate a meta-event.

[0097] Meta-event generation: Aggregates and merges all homogeneous and redundant events within a window to generate a single, high-information-density meta-event. In the formula: [ Mark the complete occurrence period of this group of homogeneous redundant events; As the main identifier; Action type; Select representative operation objects as features for retention; Record the frequency of aggregation behavior and solidify the characteristics of the attack scale.

[0098] The aforementioned meta-events are integrated into a meta-event sequence, and the compressed meta-event sequence is output: .

[0099] The pre-processed and compressed meta-event sequence is arranged in order into a structured text input format that can be recognized by the large model, and directly fed into the malicious code intent recognition model; for each meta-event in the sequence, the corresponding behavior stage is automatically matched and labeled with the standardized macro-tactical intent label under the MITRE ATT&CK system. Finally, based on the chronological order of the occurrence of the meta-events, all automatically labeled tactical intent tags are linked together, and the original behavioral evidence of the corresponding meta-events is associated to assemble a complete, traceable, and structured chronological malicious code attack chain.

[0100] In this implementation, behavioral similarity matching is performed on several four-tuple structured events within the sliding time window to obtain behavioral similarity matching results. Then, when the similarity matching results meet a preset semantic consistency condition, the aforementioned four-tuple structured events are aggregated into a single meta-event, achieving semantic-level merging of preprocessed atomic events. Traditional simple stacking methods based on fixed time windows easily forcibly merge temporally adjacent but semantically unrelated malicious behaviors, or split the same malicious operation sequence separated by time gaps into different windows, leading to mixed logic or broken behavior chains within the generated meta-events. However, the behavioral similarity matching and semantic consistency condition check introduced in this implementation can further calculate and discriminate the behavioral semantics between events within the window, building upon the initial screening of temporal proximity provided by the sliding time window. Only those four-tuple structured events that not only occur at similar times but also have highly consistent behavioral patterns and operational semantics are merged into a single meta-event.

[0101] This mechanism addresses the data redundancy issues caused by high-frequency repetition, continuous homogeneous traversal, and batch calls of the same type in power grid logs. It employs a sliding window aggregation mechanism with dual constraints of time span and behavioral semantics, which can achieve the simplification and condensation of behavioral flow while fully preserving the core characteristics and temporal logic of the attack.

[0102] As an example, in one specific implementation, the system captures raw JSON log streams containing power grid malicious code process activities and API calls. This raw data undergoes the aforementioned behavioral preprocessing and compression, and after intent identification and attack chain parsing by the malicious code intent recognition model, a structured attack chain sequence is output.

[0103] Specifically, in steps S1 to S5, this invention completes offline knowledge engineering and model fine-tuning preparation, constructing a three-layer knowledge graph based on massive historical industrial control security data, comprising micro-behavioral nodes, technical means nodes, and macro-tactical nodes. This is achieved by extracting graph node features and using a projection mapper. Minimize alignment loss Large models are now able to understand the equivalence of underlying APIs such as CheckFileExist and VirtualAlloc, and their industrial control variants, in vector space with intentions such as natural language environment detection and memory injection.

[0104] The malicious intent recognition model has undergone LoRA adaptation and fine-tuning of its basic semantics through graph prefix injection (Soft Prompt). Simultaneously, the malicious intent recognition header attached to its tail, combined with causal cue templates and a joint loss function, has been jointly trained. The model now possesses tactical discrimination capabilities that strictly adhere to the physical laws of power grid attack and defense.

[0105] In real-time, the system captured the following standardized 5-tuple raw log sequence: E1: 07:58:24 | PID:596 | API:CheckFileExist | obj: dbghelp.dll E2: 07:58:25 | PID:596 | API:DetectDebugger | obj: CpuCheck E3-E13: 07:58:25 | PID:596 | API:CreateDirectory | obj: C:\Docs\EnvCheck\... (occurred 11 times in a very short period of time) 07:58:24, 07:58:25, and 07:58:25 are the precise timestamps of the events. PID:596 is the process identifier. obj (Object) is the target object of the operation, which can be a file, directory, system component, or memory region. API:CheckFileExist indicates that the malicious code behavior is a file system probe, checking if a file exists. dbghelp.dll indicates the target file of this log entry. API:DetectDebugger indicates that the malicious code behavior is a debugger detection. CpuCheck indicates CPU detection. API:CreateDirectory indicates that the malicious code behavior is a directory creation. C:\Docs\EnvCheck\... indicates the target file address of the operation object.

[0106] The system executes a sliding window algorithm with both semantic and temporal constraints. It identifies E3-E13 as being created by the same malicious process targeting consecutive directories with the same business path prefix, aggregating these into high-information-density meta-events. : Attributes: {Time:[07:58:25.750, 07:58:25.863], Act: CreateDirectory, Count: 11, Repr_Obj:"C:\Docs\EnvCheck\sub1"}. Where 07:58:25.750 is the start timestamp of the meta-event, 07:58:25.863 is the end timestamp of the meta-event, Act:CreateDirectory indicates that the malicious code behavior is directory creation, Repr_Obj represents the operation object, C:\Docs\EnvCheck\... represents the target file address of the operation object, and Count: 11 indicates that the number of merged log sequences is 11. This method losslessly compresses 11 high-frequency noisy logs into one semantic block, greatly reducing the token inference overhead of the subsequent malicious code intent recognition model and preventing attention distraction.

[0107] The system extracts features from the compressed meta-events and uses offline-trained... Projected into the LLM embedding space, it is concatenated as a prefix feature and then used for online collaborative inference.

[0108] Finally, the system connects the intents of each stage according to the timestamp sequence and outputs a complete structured attack chain tracing report.

[0109] Please refer to Figure 3 The second aspect of the present invention provides a power grid malicious code attack chain parsing system based on intent understanding, comprising: The graph construction module 100 is used to obtain micro-behavioral nodes, technical means nodes and macro-tactical nodes based on a preset network attack knowledge base, and then use the micro-behavioral nodes, the technical means nodes and the macro-tactical nodes as graph nodes to construct a three-layer knowledge graph. Tensor generation module 200 is used to obtain ternary association paths based on the three-layer knowledge graph, generate graph node structural features and standardized instruction pairs corresponding to each ternary association path, and then obtain the fusion input tensor of each ternary association path based on the corresponding graph node structural features and standardized instruction pairs. The basic fine-tuning module 300 is used to perform semantic training on the pre-built large language base model based on all the fused input tensors to obtain the basic fine-tuning model. The identification head access module 400 is used to construct a malicious intent identification head and connect the malicious intent identification head to the basic fine-tuning model to obtain the fine-tuning model to be trained. The model training module 500 is used to construct a joint loss function and a causal prompt word template, and then train the fine-tuned model to be trained based on the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model. The attack chain parsing module 600 is used to obtain the execution log of the malicious code under test, and then parse the execution log of the malicious code under test based on the malicious code intent recognition model to obtain the malicious code attack chain.

[0110] In summary, the power grid malicious code attack chain parsing method and system based on intent understanding provided by the embodiments of the present invention has at least the following technical improvements compared with the prior art: First, this invention overcomes the inherent defects of traditional malicious behavior tracing graphs and feature association graphs, which are often flat, semantically shallow, and lack causal quantification constraints. It constructs a three-layer heterogeneous causal knowledge graph adapted to power grid malicious code analysis scenarios, encompassing micro-behavior, technical means, and macro-tactical aspects. A temporal causal confidence quantification formula is introduced to accurately filter and remove noise from cross-stage attack paths. Unlike conventional text splicing and fusion-based shallow knowledge injection methods, this invention relies on Graph Attention Networks (GAT) to extract topological features and neighborhood causal association features of graph nodes, and uses a feature projection mapper... With semantic alignment loss This approach maps structured graph features with high precision to the native token semantic embedding space of a large language model. It eliminates the semantic barrier between underlying malicious behavior features and the natural language understanding of large models at the mathematical manifold level, achieving deep integration of structured causal knowledge in the attack and defense domain with the semantic system of general large models. This endows the model with the core capability to accurately understand the essential logic of underlying micro-level malicious behavior.

[0111] Second, this invention addresses the technical pain points of general-purpose large models when applied to malicious code attack inference, such as logical jumps, misjudgments of intent, and illusions of attack paths. It abandons the conventional approach of fine-tuning with single text instructions and innovatively constructs a two-stage lightweight training architecture adapted to the security domain. In the first stage, continuous graph soft prefix injection technology is used to embed semantically aligned graph causal vectors as learnable soft prompts into the model input. Combined with LoRA low-rank adaptation, lightweight knowledge grafting is achieved, completing the basic adaptation of the large model to TTB-level attack and defense semantics. In the second stage, causal prompt templates are constructed based on the vertical hierarchical rules of TTB and the horizontal technical dependencies of ITD, introducing causal consistency loss. Strongly constrained training is implemented to force the model to learn and follow the real offensive and defensive evolution logic within the graph. Throughout the process, standard attack paths are anchored through causal loss, suppressing inference illusions and logical deviations at the root of training, thus solidifying the model's core ability to accurately identify malicious attack tactical intentions.

[0112] Third, addressing the technical challenges of high-frequency, redundant, and extremely noisy background logs of malicious code running in power grids, this invention designs an adaptive sliding window aggregation algorithm. By standardizing quadruples to achieve unified modeling of multi-source heterogeneous logs, and relying on strict behavior matching rules, it losslessly aggregates and simplifies massive amounts of repetitive API calls, homogeneous industrial control protocol interactions, and continuously traversing redundant behaviors into high-information-density, semantically robust meta-event sequences. This preprocessing mechanism significantly reduces the volume of invalid inputs and lowers the computational overhead and token consumption of large model inference while fully preserving the attack sequence, core features, and malicious evolution logic. Simultaneously, during the online parsing phase, relying on the model's learned causal priors and intent discrimination capabilities, it automatically completes the standardized annotation of tactical intents step-by-step and stage-by-stage, achieving end-to-end automated attack chain deconstruction of complex malicious code with low computational overhead.

[0113] Therefore, the power grid malicious code attack chain parsing method and system based on intent understanding provided by the embodiments of the present invention has at least the following beneficial effects compared with the prior art: First, addressing the challenge of existing large models struggling to directly understand underlying binary features, this invention innovatively introduces a three-layer mapping spectrum of "microscopic behavior—technical means—macroscopic tactics," and utilizes a feature projector and an alignment loss function ( This mechanism forces the topological features of the aggregated graph network to be projected into the natural language embedding space of the large model. This allows the system to bypass surface textual differences and accurately capture the true tactical intent behind the micro-operations at the mathematical semantic level when facing new variant attacks that employ advanced adversarial techniques such as code obfuscation, API replacement, or living-off-the-land exploitation. This elevates the accuracy of locating complex and unknown threats to an expert level.

[0114] Second, this invention addresses the fatal flaw of general-purpose large language models, which are prone to "logical jumps" when generating complex network attack and defense analysis text. Instead of simple prompting engineering and conventional cross-entropy fine-tuning, this invention designs a two-step fine-tuning mechanism and a dedicated "malicious intent recognition head." This is achieved through continuous graph prefix injection technology, combined with a tactical evolution template to apply causal consistency constraint loss (…). This invention imposes strict "laws of attack and defense physics" on large-scale models. The output attack chain is not only continuous in time, but also fully conforms to objective reality in terms of attack and defense tactical logic, eliminating the self-contradictions and misleading conclusions often found in generative models, and providing a highly reliable scientific basis for subsequent electronic forensics and liability delineation.

[0115] Third, power grid industrial control terminals and network probes generate hundreds of millions of fragmented logs daily. Directly inputting these logs into large models can lead to severe context truncation and computational overload. This invention designs an adaptive sliding window algorithm that, by executing strict aggregation rules, losslessly compresses massive amounts of repetitive atomic operations (such as cyclic encryption and lateral port brute-force) into high-information-density "meta-events." While preserving the attack sequence and feature integrity, this mechanism reduces the number of tokens input to large models by more than 90%. This not only solves the logical fragmentation problem caused by mechanical slicing of long-term covert attacks but also enables high-level tracing capabilities of large models to achieve low-latency, real-time online parsing on resource-constrained computing nodes.

[0116] Fourth, traditional discriminative models lack explanations of the attack process, while ordinary generative models lack quantified confidence outputs. This invention outputs structured tactical phase labels with high confidence scores and easily understandable explanations of attack intent. In practical applications, security operations personnel no longer need to read through tedious low-level log code, reducing the time spent investigating "alarm storms" from hours to minutes, significantly improving the response efficiency and intelligence level of power grid security situation awareness.

[0117] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0118] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; however, any combination of these technical features that does not contradict each other should be considered within the scope of this specification.

[0119] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the concept of this application, and these improvements and substitutions should also be considered within the scope of protection of this invention. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for parsing power grid malware attack chains based on intent understanding, characterized in that, include: Based on a pre-set network attack knowledge base, micro-behavioral nodes, technical means nodes, and macro-tactical nodes are obtained, and then a three-layer knowledge graph is constructed using the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes as graph nodes. Based on the three-layer knowledge graph, obtain ternary association paths, generate graph node structure features and standardized instruction pairs corresponding to each ternary association path, and then obtain the fusion input tensor of each ternary association path based on the corresponding graph node structure features and standardized instruction pairs. Based on all the aforementioned fused input tensors, semantic training is performed on the pre-constructed large language base model to obtain the basic fine-tuning model; A malicious intent identification head is constructed and connected to the basic fine-tuning model to obtain the fine-tuning model to be trained; A joint loss function and a causal prompt word template are constructed, and then the fine-tuned model to be trained is trained based on the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model; The execution logs of the malicious code to be tested are obtained, and then the execution logs of the malicious code to be tested are analyzed based on the malicious code intent recognition model to obtain the malicious code attack chain.

2. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 1, characterized in that, The process involves acquiring micro-behavioral nodes, technical means nodes, and macro-tactical nodes based on a pre-defined network attack knowledge base, and then constructing a three-layer knowledge graph using these nodes as graph nodes. This includes: Based on a pre-defined network attack knowledge base, obtain a set of micro-behavioral nodes, a set of technical means nodes, and a set of macro-tactical nodes; Based on the network attack knowledge base, a cross-layer mapping edge pointing to the corresponding technical means node is established for each micro-behavior node in the set of micro-behavior nodes; Based on the network attack knowledge base, a cross-layer mapping edge pointing to the corresponding macro-tactical node is established for each of the technical means nodes in the set of technical means nodes; The three-layer knowledge graph is constructed using all the micro-behavioral nodes, all the technical means nodes, and all the macro-tactical nodes as graph nodes, and all the cross-layer mapping edges as graph edges.

3. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 2, characterized in that, The step of obtaining ternary association paths based on the three-layer knowledge graph and generating graph node structural features and standardized instruction pairs corresponding to each ternary association path includes: Determine the set of neighbor nodes for each graph node, and then perform feature aggregation on each graph node based on the corresponding set of neighbor nodes to obtain the graph node structure features of each graph node; For any given micro-behavioral node, determine the technical means node that the micro-behavioral node points to, and determine the macro-tactical node that the technical means node points to, and then generate a ternary association path based on the micro-behavioral node, the technical means node, and the macro-tactical node. For any of the three-element association paths, the graph node structure features corresponding to the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes are taken as the graph node structure features of the three-element association path. For any of the three-ary association paths, a corresponding standardized instruction pair is generated based on a preset natural language template.

4. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 3, characterized in that, The step of obtaining the fusion input tensor for each ternary association path based on the corresponding graph node structural features and the normalization instructions includes: Construct the perceptron function and the alignment loss function; For any of the given ternary association paths: Obtain the semantic vector of the behavior node corresponding to the micro-behavioral node, the semantic vector of the technical node corresponding to the technical means node, and the semantic vector of the tactical node corresponding to the macro-tactical node; Based on the semantic vector of the behavior node, the graph node structure features corresponding to the micro-behavioral node are mapped to the corresponding continuous soft cue vector through the perceptron function and the alignment loss function; Based on the semantic vector of the technology node, the graph node structure features corresponding to the technology node are mapped into corresponding continuous soft cue vectors through the perceptron function and the alignment loss function; Based on the tactical node semantic vector, the graph node structure features corresponding to the macro tactical node are mapped to the corresponding continuous soft cue vector through the perceptron function and the alignment loss function; Obtain the word embedding vector corresponding to the standardized instruction pair; The continuous soft cue vectors corresponding to the micro-behavioral nodes, the continuous soft cue vectors corresponding to the technical means nodes, the continuous soft cue vectors corresponding to the macro-tactical nodes, and the word embedding vectors are concatenated to obtain the fusion input tensor of the ternary association path.

5. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 1, characterized in that, The process of semantically training the pre-constructed large language foundation model based on all the fused input tensors to obtain a basic fine-tuned model includes: Freeze the main intervention training parameters of the large language base model and introduce a low-rank matrix into the large language base model; Construct a forward propagation function based on the main intervention training parameters, the low-rank matrix, and all the fused input tensors; Based on the forward propagation function, the large language base model is semantically trained to obtain a basic fine-tuning model.

6. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 1, characterized in that, The step of constructing a malicious intent recognition head and connecting the malicious intent recognition head to the basic fine-tuning model to obtain the fine-tuning model to be trained includes: A first fully connected layer is constructed, and a non-linear activation layer is constructed on top of the first fully connected layer. A second fully connected layer is then constructed on top of the non-linear activation layer, and a normalization layer is constructed on top of the second fully connected layer to form the malicious intent identification head. Obtain the sequence latent feature vector output by the basic fine-tuning model; The hidden feature vectors of the sequence are connected to the first fully connected layer to obtain the fine-tuned model to be trained.

7. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 1, characterized in that, The process of constructing a joint loss function and a causal cue word template, and then training the fine-tuned model based on the joint loss function and the causal cue word template to obtain a malicious code intent recognition model, includes: Obtain the standard path description text for each of the three-element association paths; Obtain the attack path description text generated by the fine-tuning model to be trained; A semantic alignment loss function is constructed based on the pre-trained semantic encoder, the standard path description text of each of the three-way association paths, and the attack path description text. The preset cross-entropy loss function and the semantic alignment loss function are fused into the joint loss function; Several training samples are generated based on several of the aforementioned ternary association paths; A vertical causal template is generated based on any of the ternary association paths as the causal prompt word template; Based on several training samples, the fine-tuned model to be trained is trained using the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model.

8. The method for parsing power grid malicious code attack chains based on intent understanding according to claim 1, characterized in that, The process of obtaining the execution log of the malicious code under test, and then parsing the execution log based on the malicious code intent recognition model to obtain the malicious code attack chain, includes: The execution logs of the malicious code under test are preprocessed to obtain a four-tuple structured event sequence; According to a preset sliding time window, several four-tuple structured events in the four-tuple structured event sequence are aggregated to obtain several meta-events, and then the several meta-events are integrated into a meta-event sequence. The meta-event sequence is input into the malicious code intent recognition model so that the malicious code intent recognition model outputs the malicious code attack chain.

9. A method for parsing power grid malicious code attack chains based on intent understanding according to claim 8, characterized in that, The process of aggregating several four-tuple structured events in the four-tuple structured event sequence according to a preset sliding time window to obtain several meta-events, and then integrating the several meta-events into a meta-event sequence, includes: Behavioral similarity matching is performed on several of the four-tuple structured events within the sliding time window to obtain behavioral similarity matching results; If the similarity matching result meets the preset semantic consistency condition, then the several four-tuple structured events are aggregated into one meta-event.

10. A power grid malware attack chain parsing system based on intent understanding, characterized in that, include: The knowledge graph construction module is used to obtain micro-behavioral nodes, technical means nodes, and macro-tactical nodes based on a preset network attack knowledge base, and then use the micro-behavioral nodes, the technical means nodes, and the macro-tactical nodes as knowledge graph nodes to construct a three-layer knowledge graph. The tensor generation module is used to obtain ternary association paths based on the three-layer knowledge graph, generate graph node structural features and standardized instruction pairs corresponding to each ternary association path, and then obtain the fusion input tensor of each ternary association path based on the corresponding graph node structural features and standardized instruction pairs. The basic fine-tuning module is used to perform semantic training on the pre-built large language base model based on all the fused input tensors to obtain the basic fine-tuning model. The identification head access module is used to construct a malicious intent identification head and connect the malicious intent identification head to the basic fine-tuning model to obtain the fine-tuning model to be trained. The model training module is used to construct a joint loss function and a causal prompt word template, and then train the fine-tuned model to be trained based on the joint loss function and the causal prompt word template to obtain a malicious code intent recognition model; The attack chain parsing module is used to obtain the execution log of the malicious code under test, and then parse the execution log of the malicious code under test based on the malicious code intent recognition model to obtain the malicious code attack chain.

Images