A seven-element-based network attack and defense skill intelligent generation method and system

Abstract

The application provides a seven-element-based network attack and defense tactics intelligent generation method and system, relates to the technical field of network security, and comprises the following steps: acquiring multi-source heterogeneous attack and defense data and scene elements of a network attack and defense scene to be processed; performing labelization processing on the multi-source heterogeneous attack and defense data, and constructing an attack and defense disposal resource library; performing analysis and legality verification on the scene elements to obtain structured scene information; determining a seven-element structured context based on the structured scene information; taking the structured scene information and resource information in the attack and defense disposal resource library as first-stage generation prompt words, inputting the first-stage generation prompt words into a large language model, and outputting disposal resource recommendation results; performing structured analysis on the disposal resource recommendation results to obtain effective disposal resource recommendation results; taking the effective disposal resource recommendation results and the seven-element structured context as second-stage generation prompt words, inputting the second-stage generation prompt words into the large language model, and outputting a network attack and defense tactics report.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for intelligent generation of network attack and defense tactics based on seven elements. Background Technology

[0002] As the situation of cyberspace attack and defense becomes increasingly complex, cyber attack techniques are showing a trend of becoming more covert, intelligent, and diversified. New types of attack behaviors, such as memory attacks, attacks on unknown vulnerabilities, AI-generated phishing attacks, illegal covert tunnels, and advanced kernel attacks, are constantly emerging. Traditional methods of security assessment and handling based on human experience are no longer sufficient to meet the needs of rapid response.

[0003] In cybersecurity operations, attack and defense drills, and major security scenarios, security personnel not only need to identify attack behaviors, but also need to quickly formulate targeted cyberattack and defense tactics by combining factors such as attack organizations, attack techniques, attack characteristics, defense capabilities, and response measures. Therefore, how to utilize intelligent technologies to assist security personnel in completing threat analysis, attack and defense relationship characterization, and response plan generation has become a crucial issue that urgently needs to be addressed in the cybersecurity field.

[0004] However, existing technologies for generating network attack and defense analysis and response plans mainly rely on manual experience or fixed rule matching, making it difficult to dynamically generate executable response plans for specific attack scenarios. Furthermore, directly generating tactical reports using large language models is prone to problems such as inaccurate resource recommendations, incomplete content structure, and non-standard expression, resulting in insufficient reliability and practical application capabilities of the generated results. Current technologies lack a method that can combine attack-defense relationship modeling with generative model constraints to achieve intelligent generation of network attack and defense tactics. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide an intelligent generation method for network attack and defense tactics based on seven elements. This method can solve the problem that existing network attack and defense analysis and response plan generation technologies mainly rely on manual experience or fixed rule matching, making it difficult to dynamically generate executable response plans for specific attack scenarios. Furthermore, directly using large language models to generate tactics reports can easily lead to problems such as inaccurate resource recommendations, incomplete content structure, and non-standard expression, resulting in insufficient reliability and practical application capability of the generated results.

[0006] In a first aspect, this invention proposes an intelligent generation method for network attack and defense tactics based on seven elements, comprising: S1: Acquire multi-source heterogeneous attack and defense data and scenario elements of network attack and defense scenarios to be processed; S2: Tag multi-source heterogeneous attack and defense data to build an attack and defense response resource library; S3: Parse and validate the scene elements to obtain structured scene information; S4: Based on structured scene information, determine the structured context of the seven elements; S5: Use structured scene information and resource information from the attack and defense response resource library as the first-stage generated prompt words, input them into the large language model, and output the response resource recommendation results; S6: Perform structured parsing on the resource recommendation results and verify the consistency between the recommended resources and the resources in the attack and defense resource database based on the resource identifier to obtain valid resource recommendation results; S7: The effective resource recommendation results and the seven-element structured context are used as prompt words for the second stage, and the prompt words generated in the second stage are input into the large language model to output a network attack and defense tactics report.

[0007] In a second aspect, this invention proposes an intelligent generation system for network attack and defense tactics based on seven elements, comprising: a processor and a memory; The memory stores programs or instructions that can run on the processor, and when the programs or instructions are executed by the processor, they implement the steps of the intelligent generation method of network attack and defense tactics based on the seven elements in the first aspect.

[0008] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following: In this embodiment of the invention, by analyzing and validating the elements of a network attack and defense scenario, and constructing a seven-element structured context based on attack organization, attack technology, attack characteristics, protection technology, defense entity type, protection characteristics, and mitigation measures, a structured characterization of the attack and defense confrontation relationship is achieved. By adopting a two-stage constrained large language model generation mechanism, firstly, resource recommendation results are generated based on resource library constraints, and then, combined with the valid recommendation results after resource verification and the seven-element structured context, a technical and tactical report is generated. This avoids problems such as resource unavailability and incomplete content caused by direct generation of the large language model, and improves the reliability and executability of the generated results. At the same time, through resource identifier consistency verification and resource association completion, the effective association between disposal resources and technical and tactical reports is achieved, improving the automation level of network security incident analysis, judgment, and handling. Attached Figure Description

[0009] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0010] Figure 1 This is a flowchart illustrating an intelligent generation method for network attack and defense tactics based on seven elements, provided in an embodiment of the present invention.

[0011] Figure 2 This is a schematic diagram of the structure of an intelligent generation method for network attack and defense tactics based on seven elements provided in an embodiment of the present invention.

[0012] Figure 3 This is a schematic diagram of the structure of an intelligent generation system for network attack and defense tactics based on seven elements, provided in an embodiment of the present invention. Detailed Implementation

[0013] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0014] The following description, in conjunction with the accompanying drawings, details the intelligent generation method for network attack and defense tactics based on seven elements provided in this invention through specific embodiments and application scenarios.

[0015] Reference manual attached Figure 1 The diagram shows a flowchart of an intelligent generation method for network attack and defense tactics based on seven elements, provided by an embodiment of the present invention.

[0016] Reference manual attached Figure 2 The diagram shows a structural schematic of an intelligent generation method for network attack and defense tactics based on seven elements provided in an embodiment of the present invention.

[0017] This invention provides an intelligent generation method for network attack and defense tactics based on seven elements, which may include the following steps: S1: Acquire multi-source heterogeneous attack and defense data and scenario elements of network attack and defense scenarios to be processed.

[0018] Multi-source heterogeneous attack and defense data refers to a collection of cybersecurity attack and defense related data from different sources and with different data structures, including security tool data, protection entity data, and threat intelligence samples. Data from different sources differ in format, fields, and description methods, requiring subsequent processing to form a unified data foundation. Network attack and defense scenarios to be processed refer to specific cybersecurity event scenarios that require threat analysis and the generation of response plans, including information such as attack occurrence, attack methods, and protection environment. Scenario elements refer to structured information used to describe the characteristics of network attack and defense events.

[0019] In one possible implementation, the scenario elements include: attack perspective, attack method, business system, system version, network environment, and situation description.

[0020] It should be noted that this step can integrate attack and defense information from different sources and of different types, which can reduce the problem of incomplete scenario description caused by a single data source. At the same time, by collecting structured scenario elements, the subsequent model can analyze specific attack perspectives, attack methods and business environments, improve the pertinence and accuracy of network attack and defense tactics generation, and provide reliable input for subsequent seven-element relationship modeling and constrained large language model generation.

[0021] S2: Tag the multi-source heterogeneous attack and defense data to build an attack and defense response resource library.

[0022] The attack and defense response resource repository refers to a data set that stores network security response resources in a structured manner, used to preserve resource information that can be used for attack protection and incident handling. Each resource record includes at least a unique identifier, resource name, resource description, tag set, and file location, to facilitate subsequent resource retrieval, recommendation, and verification.

[0023] In one possible implementation, S2 specifically includes: S201: Acquire multi-source heterogeneous attack and defense data, including security tools, protected entities, and threat intelligence samples, and perform structured processing on each heterogeneous attack and defense data to generate corresponding resource records.

[0024] Heterogeneous attack and defense data refers to callable data used in the processes of network security attack detection, protection, response, and recovery, including security tools, protective entities, and threat intelligence samples. Resources are used to support subsequent attack analysis, generation of response plans, and response recommendations in technical and tactical reports. Resource records refer to data objects formed by structuring and describing individual attack and defense response resources, used to uniformly store resource information.

[0025] S202: Perform field standardization and resource name normalization on the resource records, and perform deduplication based on the normalized resource names to obtain standardized resource records.

[0026] Standardized resource records refer to resource data records in a unified format formed after field standardization, resource name normalization, and deduplication. These resource records serve as the foundational data for subsequent tag system matching and tag generation.

[0027] S203: For standardized resource records, construct a multi-dimensional tagging system that includes the handling stage, offensive and defensive capabilities, attack methods, and attack categories.

[0028] Among them, the multi-dimensional tag system refers to a set of tags that classify and describe attack and defense resources according to multiple dimensions, and are used to represent attributes such as the applicable scenarios, attack types and protection capabilities of resources.

[0029] S204: Based on a multi-dimensional tag system, determine the preset tag mapping relationship between resource names and tags of each dimension.

[0030] The preset tag mapping relationship refers to the pre-established correspondence between resource names and tags, used to automatically determine the tags that a resource should have based on its name. For example, by matching resource names to the preset mapping table, corresponding attack method tags and handling stage tags can be automatically added to a security tool.

[0031] S205: Based on the preset tag mapping relationship, add the dimension tags to the tag set of the corresponding resource record to obtain the tagged resource record.

[0032] Tag-based resource records refer to resource records formed by adding multi-dimensional tags based on a preset tag mapping relationship on the basis of standardized resource records. Compared with standardized resource records, tagged resource records add the ability to describe resource attributes, enabling resources to be retrieved and matched according to attack scenarios, handling stages, and protection capabilities.

[0033] S206: Verify the uniqueness of the resource identifier and the validity of the file location of the tagged resource records, and filter out resource records that fail the verification.

[0034] S207: Store the verified tagged resource records into the attack and defense handling resource library to obtain a searchable, constrainable and verifiable attack and defense handling resource library.

[0035] It should be noted that by tagging multi-source heterogeneous attack and defense data and constructing an attack and defense response resource library, unified organization and management of attack and defense resources from different sources and in different formats are achieved, improving the retrieval and usability of response resources. By establishing a multi-dimensional tagging system encompassing response stage, attack and defense capabilities, attack methods, and attack categories, resources can be associated with specific attack scenarios, providing accurate data support for subsequent response resource recommendations and the generation of technical and tactical reports. Simultaneously, through structured resource storage and resource validity verification, the integrity and accessibility of resource information are ensured, avoiding the problem of response plans being unexecutable due to missing resources or inconsistent information, thus improving the automation level of the network attack and defense response process and the reliability of the generated results.

[0036] S3: Analyze and validate the scene elements to obtain structured scene information.

[0037] Structured scenario information refers to standardized scenario data objects formed after scenario element parsing and legality verification, used to uniformly describe current network attack and defense events. Compared with the original scenario description, structured scenario information has the characteristics of clear fields, standardized content, and easy computation and processing, and can be directly used as input for subsequent derivation of the seven-element relationship and the generation of constraints for large language models.

[0038] In one possible implementation, S3 specifically refers to: By verifying the legitimacy of the attack perspective and attack methods, structured scene information is determined.

[0039] The attack methods include 12 types, such as memory-based attacks, attacks exploiting unknown vulnerabilities, attacks using gray tools, AI-generated phishing attacks, stealthy URL phishing attacks, mobile device QR code phishing attacks, illegal covert tunnels, botnet attacks, advanced kernel attacks, shared storage resource theft, slow API attacks, and data segmentation and obfuscation theft. These are categorized into four types: attack intrusion, social engineering phishing, stealthy control, and data theft.

[0040] It should be noted that by parsing and validating the elements of network attack and defense scenarios, complex and diverse attack scenario information is transformed into structured scenario information, improving the standardization and usability of scenario data. This step enables a unified description of key factors such as attack perspective, attack methods, business systems, system versions, and network environments, avoiding deviations in subsequent analysis results due to incomplete or inconsistent input information. Simultaneously, the validity verification mechanism ensures that the input scenarios meet preset requirements, providing an accurate and reliable data foundation for subsequent modeling of the seven elements of attack and defense, resource matching, and generation of technical and tactical reports, thus improving the accuracy and stability of the intelligent network attack and defense analysis process.

[0041] S4: Based on structured scene information, determine the seven-element structured context.

[0042] The seven-element structured context refers to a data context containing seven types of attack-defense relationship elements, formed based on structured scenario information through attack element deduction, defense element association, and mitigation measure mapping. This context serves as the input for the technical and tactical report generation stage, enabling the large language model to generate analysis content based on structured attack-defense relationships, rather than generating it arbitrarily.

[0043] It should be noted that this step can link the attacking organization, attack techniques, attack characteristics, and corresponding protective capabilities and mitigation measures, providing a traceable basis for judgment in the subsequent generation of technical and tactical reports, and avoiding unstable analysis results generated by large language models relying solely on their own reasoning. At the same time, through the seven-element structured modeling, a correlation is formed between attack behavior, protective capabilities, and response measures, improving the relevance, interpretability, and practical application value of the generated reports.

[0044] S5: Use structured scene information and resource information from the attack and defense response resource library as the first-stage generated prompt words, input them into the large language model, and output the response resource recommendation results.

[0045] Resource information refers to the specific resource attribute information stored in the attack and defense response resource repository, including resource identifier, resource name, resource description, resource tag, and resource file location, used to describe the basic attributes and applicability of a specific response resource. The first-stage generated prompt words refer to the constraints that limit the model's generation scope and output format when calling the large language model for response resource recommendation. These constraints mainly include: limiting the recommended resources to originate from the attack and defense response resource repository, limiting the recommendation coverage to the containment, eradication, and recovery phases, and requiring the model to output recommendation results according to a specified data structure. The large language model refers to a large-scale parametric language model based on deep learning, possessing text understanding, information analysis, and content generation capabilities. In this scheme, the large language model generates corresponding response resource recommendation results based on the input attack and defense scenario information and resource repository information, under the constraints.

[0046] The resource recommendation results refer to the resource selection results generated by the large language model based on the current network attack and defense scenario, which are used to guide the handling of subsequent attack events. These results include recommended resources for three stages: containment, eradication, and recovery, and are output in a structured format, containing stage titles, stage descriptions, and an array of tool objects. Each tool object includes a resource identifier, resource name, and recommendation reason.

[0047] In one possible implementation, S5 specifically includes: S501: Based on structured scenario information and resource information in the attack and defense handling resource library, generate the first-stage generation prompt words according to the preset prompt word template.

[0048] The preset prompt template refers to a pre-set text template used to organize input information and generate constraints. It combines structured scene information, resource library information, and generation requirements in a fixed format to form input content that the large language model can understand and execute. The first-stage generated prompt refers to the input prompt information used to drive the large language model to perform resource recommendation tasks. This prompt includes current network attack and defense scene information, resource library information, and resource recommendation constraints, used to limit the recommendation scope and output format of the large language model.

[0049] S502: Based on structured scene information and resource library constraints, the prompt words generated in the first stage are input into the large language model, and the original disposal resource recommendation results corresponding to the containment stage, eradication stage and recovery stage are output.

[0050] Among them, the resource repository constraint refers to the constraint mechanism that limits the range of large language models generated by using resource information in the attack and defense disposal resource repository. Through the resource repository constraint, the large language model can only select from existing, real disposal resources, avoiding the generation of tools or solutions that do not exist in the resource repository. The original disposal resource recommendation result refers to the resource recommendation result directly output by the large language model based on the prompt words generated in the first stage, that is, the model output result without further analysis and processing by the system.

[0051] S503: Perform structured parsing on the original disposal resource recommendation results to obtain structured disposal resource recommendation results.

[0052] The structured resource recommendation results refer to standardized resource recommendation data objects that have undergone parsing and processing. Compared to the original resource recommendation results, these results have a clear data structure and can be further processed by the system for resource identification verification, resource matching, and download address association.

[0053] S504: Constrain and limit the resource identifiers and resource names in the structured disposal resource recommendation results to obtain the disposal resource recommendation results output in the first stage.

[0054] It should be noted that by using structured scenario information and resource information from the attack and defense response resource library as constraints for the generation of the large language model, intelligent matching of response resources for specific attack scenarios is achieved, improving the targeting and accuracy of resource recommendations. Compared to directly generating response plans using the large language model, this step reduces the problem of generating unavailable or unexecutable solutions by limiting the recommended resources to the resource library. Furthermore, by generating response resource recommendations for the three stages of containment, eradication, and recovery in the first stage, a realistic and effective resource foundation is provided for the subsequent generation of technical and tactical reports, improving the reliability and executability of network attack and defense response plans.

[0055] S6: Perform structured parsing on the resource recommendation results and verify the consistency between the recommended resources and the resources in the attack and defense resource database based on the resource identifier to obtain valid resource recommendation results.

[0056] The resource identifier refers to the data identification information used to uniquely identify attack and defense resources. It is a key field connecting recommended resources and actual resource records in the resource database. Each resource has a corresponding unique identifier in the resource database. This identifier can be used to accurately locate resource records and determine whether recommended resources actually exist.

[0057] The effective resource recommendation results refer to the set of reliable recommended resources retained after structured parsing and resource identifier consistency verification. All resources in this result can be found in the attack and defense response resource repository, and their file locations or download addresses can be further linked for subsequent technical and tactical report generation and actual response execution.

[0058] In one possible implementation, S6 specifically includes: S601: Remove the code block markers from the resource recommendation results and extract the corresponding JSON text.

[0059] Code block tags refer to text identifiers automatically added by large language models when outputting structured data to represent code format, such as code quotation marks around JSON data. Since these tags are not part of the actual JSON data content, they need to be stripped before parsing to obtain valid JSON text.

[0060] JSON (JavaScript Object Notation) is a text format used for storing and exchanging structured data.

[0061] Among them, JSON text refers to the resource recommendation data text represented in JSON data format. This text stores stage information and tool object information according to a preset structure, enabling the system to convert the output of the large language model into structured data objects through a parsing program.

[0062] S602: Parse the JSON text to obtain a structured resource recommendation object containing stage titles, stage descriptions, and an array of utility objects.

[0063] Among them, the structured processing resource recommendation object refers to the standardized data object formed after parsing JSON text, which is used to represent the resource recommendation results after format conversion.

[0064] S603: Based on the resource identifiers in the attack and defense handling resource library, construct a resource index, and verify the resource identifiers of the tool objects at each stage in the structured handling resource recommendation objects based on the resource index.

[0065] Among them, the resource index refers to the data query structure established based on the resource identifiers in the attack and defense resource database, which is used to quickly locate the corresponding resource record according to the resource identifier.

[0066] Among them, resource identifier verification refers to the verification process of using the resource index to determine whether the recommended resource identifier is consistent with the resource identifier in the resource library.

[0067] S604: Based on the resource identifier verification result, recommended resources that do not exist in the resource index are identified as invalid recommendations and filtered out.

[0068] Invalid recommendations refer to recommendations that, after resource identifier verification, cannot find the corresponding resource record in the attack and defense resource database.

[0069] S605: For recommended resources that have passed verification, match the resource records in the attack and defense disposal resource library according to the corresponding resource identifier, and fill in the download address of the corresponding disposal resource to obtain the effective disposal resource recommendation result.

[0070] Download address backfilling refers to the process of finding the corresponding resource record from the attack and defense resource database based on the verified resource identifier, and adding the file location or access address of the resource to the recommendation results.

[0071] It should be noted that by performing structured parsing and resource identifier consistency verification on the resource recommendation results, effective constraints and quality control on the results generated by the large language model are achieved, improving the authenticity and reliability of the recommended resources. Since the large language model may generate non-existent resources or erroneous information, this step filters invalid recommendations by matching the recommended resources with real resources in the attack and defense response resource library, preventing unavailable or non-existent response resources from entering subsequent processes. Simultaneously, by retaining valid response resource recommendations that pass verification and establishing a link with actual resources in the resource library, a reliable resource foundation is provided for the subsequent generation of technical and tactical reports, improving the executability and application value of network attack and defense response plans.

[0072] S7: The effective resource recommendation results and the seven-element structured context are used as prompt words for the second stage, and the prompt words generated in the second stage are input into the large language model to output a network attack and defense tactics report.

[0073] The second phase of generating prompts refers to the constraint information used during the technical and tactical report generation phase to limit the scope, structure, and expression of the content generated by the large language model. The network attack and defense technical and tactical report refers to a comprehensive analysis and handling document generated for a specific network attack scenario, used to describe the attack situation, attack intent, attack and defense relationship, and corresponding handling recommendations.

[0074] In one possible implementation, S7 specifically includes: S701: Convert the effective resource disposal recommendation results into resource constraint text.

[0075] Among them, the resource constraint text refers to the textual constraint information formed by converting the effective disposal resource recommendation results into a preset format, which is used to limit the scope of disposal resources that the large language model can use during the second stage of generation.

[0076] S702: Based on resource constraint text, seven-element structured context, and preset report generation template, construct the second-stage generation prompt words.

[0077] The preset report generation template refers to predefined template rules used to organize the content structure of network attack and defense tactics reports, specifying the chapters and content organization methods that should be included in the generated report. The second-stage generation prompts refer to the input prompts used to drive the large language model to generate network attack and defense tactics reports.

[0078] S703: Configure the constraint set in the second stage of generating prompt words.

[0079] The constraint set includes report structure constraints, tool selection constraints, and judgment criteria constraints.

[0080] Among them, the report structure constraints stipulate that the report must be organized according to the above six chapters and none of them can be omitted; the tool selection constraints stipulate that the disposal suggestions can only be selected from the recommended list; and the judgment criteria constraints stipulate that the whole text should be expressed in reference-style wording such as judgment tendency, judgment basis, suggestions for attention, and key judgments required, and prohibit judgment-style, rating-style, and conclusion-style expressions.

[0081] S704: Under the constraints of the constraint set, the prompt words generated in the second stage are input into the large language model, and a network attack and defense tactics report is output.

[0082] S705: Organize the network attack and defense tactics report according to the preset chapter structure, and output the network attack and defense tactics report in a streaming manner.

[0083] Among them, the preset chapter structure refers to the predefined organizational form of the tactics and techniques report, which is used to specify the order and components of the report content.

[0084] It should be noted that by inputting the recommended effective disposal resources and the seven-element structured context as inputs to the large language model for the second-stage generation prompts, a controlled transformation from resource recommendation to the generation of technical and tactical reports was achieved, improving the accuracy and reliability of the generated content. This step utilizes the seven-element structured context to provide a basis for analyzing the relationship between attack behaviors, defense capabilities, and disposal measures, making the generated report more offensive and defensively relevant and interpretable. Simultaneously, the recommended effective disposal resources limit the range of tools selected in the report, preventing the large language model from generating disposal resources that do not exist or are unavailable. Furthermore, through report structure constraints and judgment criteria constraints, the generated report is structurally complete and standardized in expression, enhancing the practicality and application value of network attack and defense technical and tactical reports.

[0085] In one possible implementation, the pre-defined chapter structure includes: threat assessment and analysis, attacker intent analysis, analysis of the seven elements of attack and defense relationship, handling suggestions for the containment phase, handling suggestions for the eradication phase, and handling suggestions for the recovery phase.

[0086] In one possible implementation, the process after S7 includes: S8: Establish a link between the handling recommendations in the network attack and defense tactics report and the corresponding handling resources, so as to facilitate the display and acquisition of handling resources.

[0087] Among them, the handling recommendations refer to the security response measures proposed at different stages of handling cyberattacks, which are used to guide security personnel in performing operations such as attack containment, risk elimination, and system recovery.

[0088] The corresponding response resources refer to the specific security resources that match the response recommendations in the technical and tactical report, including security tools, protective entities, threat intelligence samples, etc. These response resources are sourced from an attack and defense response resource library that has undergone tagged processing and consistency verification, and contain information such as corresponding resource identifiers, resource names, and resource file locations.

[0089] Specifically, the server-side event stream sequentially pushes the resource recommendation results for Phase 1 and the report content for Phase 2. The front end first displays the recommendation results, then streams the tactics report, and provides an entry point for downloading the resources.

[0090] It's important to note that by establishing a link between the handling recommendations in the network attack and defense tactics report and the corresponding handling resources, a closed-loop connection is achieved from threat analysis and handling decision-making to resource acquisition, improving the continuity and efficiency of the network security incident handling process. This step avoids the need for security personnel to additionally search for corresponding tools after reviewing the report, ensuring that the handling measures in the report directly correspond to actually available resources. Furthermore, by associating verified and valid handling resources with the report content, the executability of the handling recommendations and the reliability of the resource sources are guaranteed, enhancing the application value of the network attack and defense tactics generation system in actual security operation scenarios.

[0091] In this embodiment of the invention, the working process of the invention is explained using a defensive perspective and a memory attack method as an example.

[0092] The first step in this implementation is to construct an attack and defense response resource library. Operations personnel import and process data, including security tools, protected entities, and threat intelligence samples, into the resource library. Threat intelligence samples are stored in separate tables according to intelligence objects and imported table by table, parsing each entry and recording the row count during import. After data standardization and deduplication by name, the data is labeled using a four-dimensional tagging system based on response stage, attack and defense capabilities, attack methods, and attack categories. Response stage tags include three categories: containment library, eradication library, and recovery library. Attack and defense capability tags include six categories: countering AI intelligence reconnaissance, countering AI vulnerability discovery, countering AI weapon generation and delivery, countering AI penetration and lateral movement, countering AI residency and C2, and countering AI data leakage. Attack method tags cover 12 attack behaviors. Attack category tags include four categories: attack intrusion, social engineering phishing, stealthy control, and data theft. Multiple dimension tags can be superimposed on the same resource; for example, a network access control tool can be simultaneously tagged with containment library, attack intrusion, and memory-based attack. Before being added to the library, the uniqueness of the resource identifier and the validity of the file location are verified. The resource repository is stored in structured data files. Each resource contains fields such as unique identifier, name, description, tag set, file location, upload time, and file size.

[0093] The second step in this embodiment is to input the elements of the attack and defense scenario. The front-end page receives the attack perspective and attack method selected by the user, as well as optional fields such as the business system, system version, network environment, and situation description. The back-end verifies the legality of the attack perspective and attack method. In this embodiment, the attack perspective is defense and the attack method is memory-based attack. Memory-based attack is classified as an attack intrusion.

[0094] The third step of the implementation is the resource recommendation for Phase One. The backend assembles scene elements and resource library data into generated prompts. The prompts require the model to recommend two disposal resources for each of the three phases: containment, eradication, and recovery. These prompts are returned as a specified JSON array structure, with the output including a phase title, phase description, and an array of tool objects. Each tool object contains a resource identifier, resource name, and recommendation reason. The resource identifier and name must be completely consistent with the resource library. The backend calls a large language model to obtain the recommendation results, strips the code block markers wrapped in the model, extracts the JSON text, and parses it into structured objects. A hash index is built using the resource library identifiers. For each phase and each tool, the identifier is checked item by item. For valid recommendations whose identifiers exist in the resource index, the download address is populated by matching the identifier with the resource library record. For invalid recommendations whose identifiers do not exist, the download address is left empty and filtered out.

[0095] The fourth step of the implementation involves the correlation reasoning of the seven elements of attack and defense. Based on scenario elements and resource library tags, the values ​​of the seven elements of the attack-defense confrontation relationship are determined, and the confrontation relationship is characterized: memory attacks are categorized as attacks / intrusions; attack organizations correspond to possible intrusion organizations; attack techniques correspond to memory injection, fileless loading, etc.; and attack characteristics correspond to process injection, fileless persistence, etc. Based on the business system, network environment, and protection resources in the resource library labeled with corresponding attack and defense capability tags, protection techniques are determined to correspond to memory protection, endpoint detection and response, etc.; defense entity types correspond to host security protection entities; and protection characteristics correspond to memory scanning, behavior monitoring, etc. Mitigation measures are mapped to three stages: containment, eradication, and recovery. The containment stage corresponds to process isolation and network blocking; the eradication stage corresponds to malicious code removal and vulnerability patching; and the recovery stage corresponds to system hardening and security baseline restoration. The above values ​​are organized into a structured context for the seven elements of the attack-defense confrontation relationship.

[0096] Step 5 of the implementation plan: Generation of the Phase 2 tactics and techniques report. The backend organizes the recommended results verified in Phase 1 into constraint text and injects the seven-element structured context into the generation prompts for Phase 2. The prompts stipulate that the report is generated in six chapters: threat assessment and analysis, attacker intent analysis, analysis of the seven elements of attack and defense, handling suggestions for the containment phase, handling suggestions for the eradication phase, and handling suggestions for the recovery phase. The seven-element analysis describes the adversarial relationship between the attacking organization, attack techniques, attack characteristics, protection techniques, types of defense entities, protection characteristics, and mitigation measures item by item based on the structured context, serving as the basis for the assessment trends in the first two chapters; the handling suggestions only select tools from the recommended list in Phase 1; the entire text uses reference-style expressions such as assessment trends, assessment basis, suggestions for attention, and areas requiring key assessment, prohibiting judgment-style, rating-style, and conclusion-style expressions; the report output is in a valid HTML format.

[0097] Step 6 of the implementation example: Front-end interactive display. The back-end first pushes the first-stage recommendation results via server-side event stream. The front-end displays two recommended resources for each of the three stages: containment, eradication, and recovery, along with their download links. Subsequently, the back-end streams the report content, and the front-end renders and generates the report in real time. Operations personnel can view the report and obtain the resources for handling while doing so.

[0098] In this embodiment of the invention, by analyzing and validating the elements of a network attack and defense scenario, and constructing a seven-element structured context based on attack organization, attack technology, attack characteristics, protection technology, defense entity type, protection characteristics, and mitigation measures, a structured characterization of the attack and defense confrontation relationship is achieved. By adopting a two-stage constrained large language model generation mechanism, firstly, resource recommendation results are generated based on resource library constraints, and then, combined with the valid recommendation results after resource verification and the seven-element structured context, a technical and tactical report is generated. This avoids problems such as resource unavailability and incomplete content caused by direct generation of the large language model, and improves the reliability and executability of the generated results. At the same time, through resource identifier consistency verification and resource association completion, the effective association between disposal resources and technical and tactical reports is achieved, improving the automation level of network security incident analysis, judgment, and handling.

[0099] Reference manual attached Figure 3 The diagram shows a structural schematic of a network attack and defense tactics intelligent generation system based on seven elements provided in an embodiment of the present invention.

[0100] This invention provides a network attack and defense tactics intelligent generation system 20 based on seven elements, including: processor 201 and memory 202.

[0101] The memory 202 stores programs or instructions that can run on the processor 201. When the program or instructions are executed by the processor 201, they implement the steps of the above-mentioned intelligent generation method of network attack and defense tactics based on seven elements and achieve the same technical effect. To avoid repetition, the present invention will not elaborate further.

[0102] It should be understood that the processor 201 in this embodiment of the invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0103] It should also be understood that the memory 202 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DR RAM).

[0104] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0105] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0106] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0107] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0108] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0109] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0111] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0112] This invention provides a readable storage medium, including: storing a program or instructions on the readable storage medium, wherein when the program or instructions are executed by a processor, they implement the steps of the above-described intelligent generation method for network attack and defense tactics based on seven elements, and can achieve the same technical effect. To avoid repetition, this invention will not elaborate further.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A method for intelligently generating network attack and defense tactics based on seven elements, characterized in that, include: S1: Acquire multi-source heterogeneous attack and defense data and scenario elements of network attack and defense scenarios to be processed; S2: Tag the multi-source heterogeneous attack and defense data to build an attack and defense response resource library; S3: Parse and validate the scene elements to obtain structured scene information; S4: Based on the structured scene information, determine the seven-element structured context; S5: The structured scene information and the resource information in the attack and defense handling resource library are used as prompt words to be generated in the first stage, and input into the large language model to output the handling resource recommendation results; S6: Perform structured parsing on the resource recommendation results and verify the consistency between the recommended resources and the resources in the attack and defense resource database based on the resource identifier to obtain valid resource recommendation results; S7: The recommended results of effective disposal resources and the seven-element structured context are used as prompt words for the second stage, and the prompt words generated in the second stage are input into the large language model to output a network attack and defense tactics report.

2. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 1, characterized in that, The scenario elements include: attack perspective, attack method, business system, system version, network environment, and situation description.

3. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 1, characterized in that, S2 specifically includes: S201: Acquire multi-source heterogeneous attack and defense data, including security tools, protected entities, and threat intelligence samples, and perform structured processing on each heterogeneous attack and defense data to generate corresponding resource records; S202: Perform field standardization and resource name normalization on the resource records, and perform deduplication based on the normalized resource names to obtain standardized resource records; S203: For the standardized resource records, construct a multi-dimensional tagging system including the handling stage, attack and defense capabilities, attack methods, and attack categories; S204: Based on the multi-dimensional tag system, determine the preset tag mapping relationship between resource names and tags of each dimension; S205: Based on the preset tag mapping relationship, add the dimension tags to the tag set of the corresponding resource record to obtain the tagged resource record; S206: Verify the uniqueness of the resource identifier and the validity of the file location of the tagged resource records, and filter out resource records that fail the verification; S207: Store the verified tagged resource records into the attack and defense handling resource library to obtain a searchable, constrainable and verifiable attack and defense handling resource library.

4. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 2, characterized in that, Specifically, S3 is: The structured scene information is determined by verifying the legality of the attack perspective and the attack method.

5. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 1, characterized in that, S5 specifically includes: S501: Based on the structured scene information and the resource information in the attack and defense resource library, generate the first stage generation prompt words according to the preset prompt word template; S502: Based on the structured scene information and resource library constraints, the prompt words generated in the first stage are input into the large language model, and the original disposal resource recommendation results corresponding to the containment stage, eradication stage and recovery stage are output; S503: Perform structured parsing on the original disposal resource recommendation results to obtain structured disposal resource recommendation results; S504: Constrain and limit the resource identifiers and resource names in the structured disposal resource recommendation results to obtain the disposal resource recommendation results output in the first stage.

6. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 1, characterized in that, S6 specifically includes: S601: Remove the code block markers from the resource recommendation results and extract the corresponding JSON text; S602: Parse the JSON text to obtain a structured resource recommendation object containing a stage title, stage description, and an array of tool objects; S603: Based on the resource identifiers in the attack and defense handling resource library, construct a resource index, and verify the resource identifiers of the tool objects at each stage in the structured handling resource recommendation object based on the resource index; S604: Based on the resource identifier verification result, recommended resources that do not exist in the resource index are identified as invalid recommendations and filtered out; S605: For the recommended resources that have passed the verification, match the resource records in the attack and defense handling resource library according to the corresponding resource identifier, and fill in the download address of the corresponding handling resource to obtain the effective handling resource recommendation result.

7. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 1, characterized in that, Specifically, S7 includes: S701: Convert the effective resource recommendation results into resource constraint text; S702: Based on the resource constraint text, the seven-element structured context, and the preset report generation template, construct the second-stage generation prompt words; S703: Configure the constraint set in the second stage of generating prompt words; S704: Under the constraints of the constraint set, input the prompt words generated in the second stage into the large language model and output the network attack and defense tactics report; S705: Organize the network attack and defense tactics report according to the preset chapter structure, and output the network attack and defense tactics report in a streaming manner.

8. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 7, characterized in that, The pre-defined chapter structure includes: threat assessment and analysis, attacker intent analysis, analysis of the seven elements of attack and defense relationship, handling suggestions for the containment phase, handling suggestions for the eradication phase, and handling suggestions for the recovery phase.

9. The intelligent generation method for network attack and defense tactics based on seven elements according to claim 1, characterized in that, Following S7, the following is also included: S8: Establish the association between the handling suggestions in the network attack and defense tactics report and the corresponding handling resources, so as to display and obtain handling resources.

10. A network attack and defense tactics intelligent generation system based on seven elements, characterized in that, include: Processor and memory; The memory stores programs or instructions that can run on the processor, and when the program or instructions are executed by the processor, they implement the steps of the intelligent generation method for network attack and defense tactics based on seven elements as described in any one of claims 1 to 9.

Images